import { NextResponse } from "next/server";
import { getServerSession } from "next-auth";
import { authOptions } from "@/lib/auth/auth-options";
import { initDb } from "@/lib/db";
import { requireActiveSuperAdmin } from "@/lib/auth/verify-session-user";
import {
  applySessionCookie,
  encodeSessionJwt,
  IMPERSONATION_MAX_AGE_SEC,
} from "@/lib/auth/session-cookie";

/**
 * Super-admin only: switch the session into a client workspace.
 * Passwords are hashed and cannot be viewed — this is the support path.
 */
export async function POST(request: Request) {
  const session = await getServerSession(authOptions);
  if (!session?.user?.id) {
    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
  }

  const admin = await requireActiveSuperAdmin(session.user.id);
  if (!admin) {
    return NextResponse.json({ error: "Forbidden" }, { status: 403 });
  }

  let workspaceId = "";
  try {
    const body = (await request.json()) as { workspaceId?: string };
    workspaceId = body.workspaceId ?? "";
  } catch {
    return NextResponse.json({ error: "Invalid request" }, { status: 400 });
  }

  if (!workspaceId) {
    return NextResponse.json({ error: "Missing workspace" }, { status: 400 });
  }

  const { User, Workspace, AuditLog } = initDb();
  const workspace = await Workspace.findByPk(workspaceId);
  if (!workspace) {
    return NextResponse.json({ error: "Workspace not found" }, { status: 404 });
  }

  const client = await User.findOne({
    where: { workspaceId, role: "client", isActive: true },
    order: [["createdAt", "ASC"]],
  });

  if (!client?.workspaceId) {
    return NextResponse.json(
      { error: "No active client user in this workspace" },
      { status: 404 }
    );
  }

  await AuditLog.create({
    actorUserId: admin.id,
    workspaceId,
    action: "admin.impersonate_client",
    metadata: {
      message: `Admin viewed workspace "${workspace.name}" as ${client.email}`,
      clientUserId: client.id,
      clientEmail: client.email,
    },
  });

  const jwt = await encodeSessionJwt(
    {
      id: client.id,
      role: "client",
      workspaceId: client.workspaceId,
      name: client.name,
      email: client.email,
      picture: client.avatarUrl,
      impersonatorAdminId: admin.id,
    },
    IMPERSONATION_MAX_AGE_SEC
  );

  const url = new URL(request.url);
  const secure = process.env.NEXTAUTH_URL?.startsWith("https://") ?? url.protocol === "https:";
  const res = NextResponse.json({ ok: true, redirectTo: "/app/dashboard" });
  applySessionCookie(res, jwt, secure, IMPERSONATION_MAX_AGE_SEC);
  return res;
}