import { NextRequest, NextResponse } from "next/server";
import { db } from "@/lib/admin/db";
import { requireMainAdmin, getClientMetadata } from "@/lib/admin/auth";

export const dynamic = "force-dynamic";

export async function GET(req: NextRequest) {
  try {
    await requireMainAdmin(req);
    const settings = await db.getSettings();
    return NextResponse.json({ settings });
  } catch (error) {
    const status = (error as unknown as { status: number }).status || 500;
    return NextResponse.json(
      { error: (error as Error).message || "Access denied." },
      { status }
    );
  }
}

export async function POST(req: NextRequest) {
  try {
    const { user: mainAdmin } = await requireMainAdmin(req);
    const { ip } = getClientMetadata(req);

    const body = await req.json();
    const previous = await db.getSettings();

    const updates: Record<string, unknown> = {};
    if (typeof body.require2FAForAllSubAdmins === "boolean") {
      updates.require2FAForAllSubAdmins = body.require2FAForAllSubAdmins;
    }
    if (typeof body.sessionTimeoutMinutes === "number" && body.sessionTimeoutMinutes >= 15) {
      updates.sessionTimeoutMinutes = body.sessionTimeoutMinutes;
    }
    if (typeof body.maxLoginAttempts === "number" && body.maxLoginAttempts >= 3) {
      updates.maxLoginAttempts = body.maxLoginAttempts;
    }

    const updated = await db.updateSettings(updates, mainAdmin.email);

    // Security Audit logging (NEVER log secrets!)
    await db.logSecurityEvent({
      actorId: mainAdmin.id,
      actorName: mainAdmin.name,
      actorEmail: mainAdmin.email,
      actorLevel: mainAdmin.level,
      targetUserId: null,
      targetUserEmail: null,
      targetUserName: null,
      action: "SETTINGS_CHANGED",
      details: {
        previousSettings: {
          require2FAForAllSubAdmins: previous.require2FAForAllSubAdmins,
          sessionTimeoutMinutes: previous.sessionTimeoutMinutes,
          maxLoginAttempts: previous.maxLoginAttempts,
        },
        newSettings: {
          require2FAForAllSubAdmins: updated.require2FAForAllSubAdmins,
          sessionTimeoutMinutes: updated.sessionTimeoutMinutes,
          maxLoginAttempts: updated.maxLoginAttempts,
        },
      },
      ipAddress: ip,
    });

    return NextResponse.json({
      ok: true,
      settings: updated,
      message: "Security settings updated successfully.",
    });
  } catch (error) {
    const status = (error as unknown as { status: number }).status || 500;
    return NextResponse.json(
      { error: (error as Error).message || "Failed to update security settings." },
      { status }
    );
  }
}