import { NextRequest, NextResponse } from "next/server";
import { getAdminSession, getClientMetadata, extractRawToken } from "@/lib/admin/auth";
import { db, hashToken } from "@/lib/admin/db";
import { getNetworkSecurity, resolveClientIp } from "@/lib/admin/network-security";

export const dynamic = "force-dynamic";

/**
 * GET /api/admin/security/network-check
 * Evaluates current incoming network security identity against policy.
 * Used at session boundaries (e.g. tab visibility resume, periodic check)
 * without incurring continuous polling.
 */
export async function GET(req: NextRequest) {
  try {
    const rawToken = await extractRawToken(req);
    if (!rawToken) {
      return NextResponse.json({ error: "Unauthenticated" }, { status: 401 });
    }

    const tokenHash = hashToken(rawToken);
    const session = await db.getSessionByTokenHash(tokenHash);
    if (!session || session.revoked) {
      return NextResponse.json({ error: "Session expired or revoked" }, { status: 401 });
    }

    const clientIp = resolveClientIp(req);
    const netSec = await getNetworkSecurity(clientIp, req);

    if (netSec.isBlocked) {
      // Revoke session immediately
      await db.updateSessionNetworkSecurity(tokenHash, netSec);
      await db.revokeSession(
        tokenHash,
        "SYSTEM",
        netSec.blockReason || "Disallowed anonymized network detected during revalidation"
      );

      const { location, userAgent } = getClientMetadata(req);
      await db.createAuditLog({
        action: "NETWORK_SECURITY_BLOCKED",
        status: "FAILURE",
        userId: session.userId,
        targetType: "SESSION",
        targetId: session.id,
        details: {
          reason: netSec.blockReason || "VPN / Proxy / Tor detected during revalidation",
          signals: {
            vpn: netSec.isVpn,
            proxy: netSec.isProxy,
            tor: netSec.isTor,
            relay: netSec.isRelay,
          },
          provider: netSec.provider,
          ip: netSec.ip,
          asn: netSec.asn,
        },
        location: session.location || location,
        networkSecurity: netSec,
        ipAddress: clientIp,
        userAgent,
      });

      return NextResponse.json(
        {
          blocked: true,
          code: "NETWORK_BLOCKED",
          error:
            "Admin access blocked: For security reasons, Quto AI does not allow administrator access through VPN, proxy, Tor, or anonymized network connections. Please disable your VPN/proxy and sign in again.",
          network: {
            isVpn: netSec.isVpn,
            isProxy: netSec.isProxy,
            isTor: netSec.isTor,
            isRelay: netSec.isRelay,
            reason: netSec.blockReason,
          },
        },
        { status: 403 }
      );
    }

    // Update session network security cache
    await db.updateSessionNetworkSecurity(tokenHash, netSec);

    return NextResponse.json({
      blocked: false,
      ok: true,
      network: {
        ip: netSec.ip,
        isVpn: false,
        risk: netSec.risk,
      },
    });
  } catch (error: any) {
    console.error("[GET /api/admin/security/network-check] Error:", error);
    return NextResponse.json(
      { error: error.message || "Failed to verify network security" },
      { status: 500 }
    );
  }
}