import { getServerSession } from "next-auth";
import { redirect } from "next/navigation";
import { authOptions } from "@/lib/auth/auth-options";
import { initDb } from "@/lib/db";
import {
  requireActiveUser,
  requireActiveSuperAdmin,
} from "@/lib/auth/verify-session-user";
import { loginRedirectUrl } from "@/lib/auth/post-auth-path";
import type { UserRole } from "@/types";

/** Get session or redirect to login. Re-validates isActive from DB. */
export async function requireAuth() {
  const session = await getServerSession(authOptions);
  if (!session?.user?.id) {
    redirect(loginRedirectUrl("SessionRequired"));
  }

  let dbUser;
  try {
    dbUser = await requireActiveUser(session.user.id);
  } catch {
    redirect(loginRedirectUrl("DatabaseError"));
  }

  if (!dbUser) {
    redirect(loginRedirectUrl("AccountInactive"));
  }

  try {
    const { getPlatformSettings } = await import(
      "@/lib/queries/system-settings-queries"
    );
    const platform = await getPlatformSettings();
    if (platform.maintenanceMode) {
      const admin = await requireActiveSuperAdmin(session.user.id);
      if (!admin) {
        redirect(loginRedirectUrl("maintenance"));
      }
    }
  } catch {
    // If settings cannot be read, do not lock everyone out of the app.
  }

  return session;
}

/** Require a client role with an assigned workspace. */
export async function requireClientWorkspace() {
  const session = await requireAuth();

  let dbUser;
  try {
    dbUser = await requireActiveUser(session.user.id);
  } catch {
    redirect(loginRedirectUrl("DatabaseError"));
  }
  if (!dbUser) redirect(loginRedirectUrl("AccountInactive"));

  const role = dbUser.role as UserRole;

  if (role !== "client" && role !== "super_admin") {
    redirect(loginRedirectUrl("Forbidden"));
  }

  if (!dbUser.workspaceId) {
    if (role === "super_admin") {
      redirect("/admin/overview");
    }
    redirect("/onboarding");
  }

  let workspace;
  try {
    const { Workspace } = initDb();
    workspace = await Workspace.findByPk(dbUser.workspaceId);
  } catch {
    redirect(loginRedirectUrl("DatabaseError"));
  }

  if (!workspace || workspace.isSuspended) {
    redirect(loginRedirectUrl("WorkspaceUnavailable"));
  }

  return {
    session,
    userId: dbUser.id,
    workspaceId: dbUser.workspaceId,
  };
}