import { getServerSession } from "next-auth";
import { authOptions } from "@/lib/auth/auth-options";
import { initDb } from "@/lib/db";
import { getScopedSurvey } from "@/lib/queries/survey-queries";
import {
  requireActiveUser,
  requireActiveSuperAdmin,
} from "@/lib/auth/verify-session-user";
import type { UserRole } from "@/types";

/** Verify session + workspace access to a survey for export routes. */
export async function requireSurveyExportAccess(surveyId: string) {
  const session = await getServerSession(authOptions);
  if (!session?.user?.id) {
    return { error: "Unauthorized" as const, status: 401 as const };
  }

  const dbUser = await requireActiveUser(session.user.id);
  if (!dbUser) {
    return { error: "Unauthorized" as const, status: 401 as const };
  }

  const role = dbUser.role as UserRole;
  if (role !== "client" && role !== "super_admin") {
    return { error: "Forbidden" as const, status: 403 as const };
  }

  if (role === "super_admin") {
    const admin = await requireActiveSuperAdmin(dbUser.id);
    if (!admin) {
      return { error: "Forbidden" as const, status: 403 as const };
    }
  }

  const workspaceId = dbUser.workspaceId;
  if (!workspaceId) {
    return { error: "No workspace" as const, status: 403 as const };
  }

  const { Workspace } = initDb();
  const workspace = await Workspace.findByPk(workspaceId);
  if (!workspace || workspace.isSuspended) {
    return { error: "Forbidden" as const, status: 403 as const };
  }

  const survey = await getScopedSurvey(surveyId, workspaceId);
  if (!survey) {
    return { error: "Not found" as const, status: 404 as const };
  }

  return { survey, workspaceId };
}