import { NextResponse } from "next/server";
import { getToken } from "next-auth/jwt";
import { initDb } from "@/lib/db";
import {
  applySessionCookie,
  encodeSessionJwt,
} from "@/lib/auth/session-cookie";

/** Restore the original super-admin session after viewing a client workspace. */
export async function POST(request: Request) {
  const token = await getToken({
    req: request as never,
    secret: process.env.NEXTAUTH_SECRET,
  });

  const adminId =
    typeof token?.impersonatorAdminId === "string"
      ? token.impersonatorAdminId
      : null;

  if (!adminId) {
    return NextResponse.json({ error: "Not impersonating" }, { status: 400 });
  }

  const { User } = initDb();
  const admin = await User.findByPk(adminId);
  if (!admin?.isActive || admin.role !== "super_admin") {
    return NextResponse.json({ error: "Admin session expired" }, { status: 401 });
  }

  const jwt = await encodeSessionJwt({
    id: admin.id,
    role: "super_admin",
    workspaceId: admin.workspaceId ?? null,
    name: admin.name,
    email: admin.email,
    picture: admin.avatarUrl,
  });

  const url = new URL(request.url);
  const secure =
    process.env.NEXTAUTH_URL?.startsWith("https://") ??
    url.protocol === "https:";
  const res = NextResponse.json({ ok: true, redirectTo: "/admin/clients" });
  applySessionCookie(res, jwt, secure);
  return res;
}