import { NextResponse } from "next/server";
import { createAdminClient, createClient } from "@/lib/supabase-server";

function isValidEmail(value: string) {
  return /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(value);
}

async function findAuthUserIdByEmail(admin: ReturnType<typeof createAdminClient>, email: string) {
  const adminAuth = admin.auth.admin as unknown as {
    getUserByEmail?: (value: string) => Promise<{ data: { user: { id: string } | null } | null; error: unknown | null }>;
    listUsers: (value: { page?: number; perPage?: number }) => Promise<{ data: { users: Array<{ id: string; email: string | null }> } | null; error: unknown | null }>;
  };

  if (typeof adminAuth.getUserByEmail === "function") {
    const { data, error } = await adminAuth.getUserByEmail(email);
    if (!error && data?.user?.id) return data.user.id;
  }

  const perPage = 1000;
  for (let page = 1; page <= 50; page += 1) {
    const { data, error } = await adminAuth.listUsers({ page, perPage });
    if (error) return null;
    const users = data?.users ?? [];
    if (!users.length) return null;

    const found = users.find((u) => (u.email ?? "").trim().toLowerCase() === email);
    if (found?.id) return found.id;

    if (users.length < perPage) return null;
  }

  return null;
}

function normalizePlan(value: unknown) {
  if (value === "mensal" || value === "anual") return value;
  return "mensal";
}

function planDefaults(plan: "mensal" | "anual") {
  if (plan === "anual") {
    return { name: "Ktalogu - Anual", days: 365 };
  }
  return { name: "Ktalogu - Mensal", days: 30 };
}

function addDays(base: Date, days: number) {
  const next = new Date(base);
  next.setDate(next.getDate() + days);
  return next;
}

function getResetBaseUrl(req: Request) {
  // Forçar URL de produção para garantir HTTPS e domínio correto
  if (process.env.NODE_ENV === "production") {
    return "https://admin.ktalogu.com.br";
  }

  const envBase = process.env.NEXT_PUBLIC_ADMIN_BASE_URL || process.env.ADMIN_BASE_URL;
  if (envBase) {
    return envBase.replace(/\/$/, "");
  }
  const forwardedProto = req.headers.get("x-forwarded-proto");
  const forwardedHost = req.headers.get("x-forwarded-host");
  const host = req.headers.get("host");
  const proto = forwardedProto || "http"; // Default to http if proto not found
  const resolvedHost = forwardedHost || host;
  if (resolvedHost) {
    return `${proto}://${resolvedHost}`.replace(/\/$/, "");
  }
  return "";
}

export async function POST(req: Request) {
  const supabase = await createClient();
  const {
    data: { user },
  } = await supabase.auth.getUser();

  if (!user || !user.email) {
    return NextResponse.json({ error: "Não autenticado." }, { status: 401 });
  }

  /* Só o dono da PLATAFORMA. Antes a conferência era "é dono da própria
     empresa" — o que todo cliente é — e qualquer um podia se dar acesso até
     2099. Sem OWNER_ACCESS_EMAILS no servidor, ninguém passa. */
  const permitidos = String(process.env.OWNER_ACCESS_EMAILS || "")
    .split(",")
    .map((item) => item.trim().toLowerCase())
    .filter(Boolean);
  if (!permitidos.includes(user.email.trim().toLowerCase())) {
    return NextResponse.json({ error: "Sem permissão." }, { status: 403 });
  }

  const body = (await req.json().catch(() => null)) as
    | {
        email?: unknown;
        name?: unknown;
        plan?: unknown;
        plan_name?: unknown;
        status?: unknown;
        expires_at?: unknown;
      }
    | null;

  const email = typeof body?.email === "string" ? body.email.trim().toLowerCase() : "";
  const name = typeof body?.name === "string" ? body.name.trim() : "";
  const plan = normalizePlan(body?.plan);
  const status = typeof body?.status === "string" ? body.status.trim().toLowerCase() : "active";
  const planNameInput = typeof body?.plan_name === "string" ? body.plan_name.trim() : "";
  const expiresAtRaw = typeof body?.expires_at === "string" ? body.expires_at.trim() : "";

  if (!email || !isValidEmail(email)) {
    return NextResponse.json({ error: "Email inválido." }, { status: 400 });
  }

  const defaults = planDefaults(plan);
  const planName = planNameInput || defaults.name;

  let expiresAt: string | null = null;
  if (expiresAtRaw) {
    const parsed = new Date(expiresAtRaw);
    if (Number.isNaN(parsed.getTime())) {
      return NextResponse.json({ error: "Data de expiração inválida." }, { status: 400 });
    }
    expiresAt = parsed.toISOString();
  } else {
    expiresAt = addDays(new Date(), defaults.days).toISOString();
  }

  const admin = createAdminClient();

  let authUserId = await findAuthUserIdByEmail(admin, email);
  if (!authUserId) {
    const { data: created, error: createError } = await admin.auth.admin.createUser({
      email,
      email_confirm: true,
    });
    const createdUserId =
      typeof (created as { user?: { id?: string } } | null | undefined)?.user?.id === "string"
        ? (created as { user?: { id?: string } } | null | undefined)!.user!.id!
        : null;
    if (createError && !createdUserId) {
      return NextResponse.json({ error: "Não foi possível criar o usuário." }, { status: 500 });
    }
    authUserId = createdUserId;
  }

  const { data: existing, error: existingError } = await admin
    .from("users_app")
    .select("id")
    .ilike("email", email)
    .maybeSingle();

  if (existingError) {
    return NextResponse.json({ error: "Falha ao verificar usuário." }, { status: 500 });
  }

  const payload = {
    email,
    name: name || null,
    status: status || "active",
    expires_at: expiresAt,
    plan: plan,
    plan_name: planName,
    plano: plan,
    updated_at: new Date().toISOString(),
  };

  if (existing?.id) {
    const { error } = await admin.from("users_app").update(payload).eq("id", existing.id);
    if (error) {
      return NextResponse.json({ error: "Falha ao atualizar acesso." }, { status: 500 });
    }
    const origin = getResetBaseUrl(req);
    const { error: resetError } = await admin.auth.resetPasswordForEmail(email, {
      redirectTo: `${origin}/auth/callback?next=/reset-password`,
    });
    return NextResponse.json({
      ok: true,
      mode: "updated",
      email_sent: !resetError,
    });
  }

  const { error } = await admin.from("users_app").insert({
    ...payload,
    created_at: new Date().toISOString(),
  });

  if (error) {
    return NextResponse.json({ error: "Falha ao conceder acesso." }, { status: 500 });
  }

  const origin = getResetBaseUrl(req);
  const { error: resetError } = await admin.auth.resetPasswordForEmail(email, {
    redirectTo: `${origin}/auth/callback?next=/reset-password`,
  });

  return NextResponse.json({
    ok: true,
    mode: "created",
    email_sent: !resetError,
  });
}