import { NextRequest, NextResponse } from "next/server";
import {
  db,
  hashPassword,
  generateTemporaryPassword,
} from "@/lib/admin/db";
import { requireMainAdmin, getClientMetadata } from "@/lib/admin/auth";
import { sendMail } from "@/lib/mail";
import { renderEmail } from "@/emails/render";
import { AdminPasswordResetEmail } from "@/emails/templates/admin-password-reset";

export const dynamic = "force-dynamic";

export async function GET(req: NextRequest) {
  try {
    await requireMainAdmin(req);
    const requests = await db.getResetRequests();
    return NextResponse.json({ requests });
  } catch (error) {
    const status = (error as unknown as { status: number }).status || 500;
    return NextResponse.json(
      { error: (error as Error).message || "Failed to load reset requests." },
      { status }
    );
  }
}

export async function POST(req: NextRequest) {
  try {
    const { user: mainAdmin } = await requireMainAdmin(req);
    const { ip } = getClientMetadata(req);

    const body = await req.json();
    const requestId = typeof body.requestId === "string" ? body.requestId : "";
    const action = body.action as "APPROVE" | "REJECT";
    const reason = typeof body.reason === "string" ? body.reason : undefined;

    if (!requestId || !action) {
      return NextResponse.json(
        { error: "Request ID and action are required." },
        { status: 400 }
      );
    }

    const requests = await db.getResetRequests();
    const targetRequest = requests.find((r) => r.id === requestId);
    if (!targetRequest) {
      return NextResponse.json({ error: "Reset request not found." }, { status: 404 });
    }

    if (targetRequest.status !== "PENDING") {
      return NextResponse.json(
        { error: `This request has already been ${targetRequest.status.toLowerCase()}.` },
        { status: 400 }
      );
    }

    const targetUser = await db.getUserById(targetRequest.userId);
    if (!targetUser) {
      await db.updateResetRequest(requestId, "EXPIRED", mainAdmin.email, "Target user no longer exists");
      return NextResponse.json({ error: "Target administrator account no longer exists." }, { status: 404 });
    }

    if (action === "REJECT") {
      await db.updateResetRequest(requestId, "REJECTED", mainAdmin.email, reason || "Rejected by Main Administrator");

      await db.logSecurityEvent({
        actorId: mainAdmin.id,
        actorName: mainAdmin.name,
        actorEmail: mainAdmin.email,
        actorLevel: mainAdmin.level,
        targetUserId: targetUser.id,
        targetUserEmail: targetUser.email,
        targetUserName: targetUser.name,
        action: "PASSWORD_RESET_REJECTED",
        details: {
          requestId,
          reason: reason || "Rejected by Main Admin",
        },
        ipAddress: ip,
      });

      return NextResponse.json({
        ok: true,
        message: `Password reset request for ${targetUser.name} was rejected.`,
      });
    }

    // APPROVE
    const temporaryPassword = generateTemporaryPassword();
    const { hash, salt } = hashPassword(temporaryPassword);

    await db.updateUser(targetUser.id, {
      passwordHash: hash,
      passwordSalt: salt,
      passwordChangeRequired: true,
    });

    // Invalidate all active sessions immediately
    await db.revokeAllSessionsForUser(
      targetUser.id,
      mainAdmin.email,
      "Password reset approved by Main Administrator"
    );

    await db.updateResetRequest(
      requestId,
      "APPROVED",
      mainAdmin.email,
      reason || "Approved and reset by Main Administrator"
    );

    await db.logSecurityEvent({
      actorId: mainAdmin.id,
      actorName: mainAdmin.name,
      actorEmail: mainAdmin.email,
      actorLevel: mainAdmin.level,
      targetUserId: targetUser.id,
      targetUserEmail: targetUser.email,
      targetUserName: targetUser.name,
      action: "PASSWORD_RESET_COMPLETED",
      details: {
        requestId,
        note: "Approved from reset queue; active sessions revoked; forced password change enabled",
      },
      ipAddress: ip,
    });

    let emailSent = false;
    try {
      const { html, text } = await renderEmail(
        AdminPasswordResetEmail({
          name: targetUser.name,
          email: targetUser.email,
          temporaryPassword,
        })
      );

      await sendMail({
        to: targetUser.email,
        subject: "Your Quto AI Admin Password Has Been Reset",
        html,
        text,
      });
      emailSent = true;
    } catch (mailError) {
      console.error("[reset-requests] Error sending reset email:", mailError);
    }

    return NextResponse.json({
      ok: true,
      temporaryPassword,
      emailSent,
      message: emailSent
        ? `Reset approved. New temporary password sent to ${targetUser.email}.`
        : `Reset approved, but delivery email failed. Please provide the key manually.`,
    });
  } catch (error) {
    const status = (error as unknown as { status: number }).status || 500;
    return NextResponse.json(
      { error: (error as Error).message || "Failed to process reset request." },
      { status }
    );
  }
}