const express = require('express');
const bcrypt = require('bcryptjs');
const pool = require('../db');
const { loadStaffUser, staffAuthPayload } = require('../middleware/auth');

const router = express.Router();

router.get('/me', async (req, res) => {
  const userId = req.session?.userId;
  if (!userId) {
    return res.json({ role: 'user' });
  }

  try {
    const user = await loadStaffUser(userId);
    if (!user || !user.is_active) {
      req.session.destroy(() => {});
      return res.json({ role: 'user' });
    }

    res.json(staffAuthPayload(user));
  } catch (err) {
    console.error('Auth me error:', err.message);
    res.status(500).json({ error: 'Failed to read session' });
  }
});

router.post('/login', async (req, res) => {
  const { username, password } = req.body ?? {};
  if (!username || typeof username !== 'string' || !password || typeof password !== 'string') {
    return res.status(400).json({ error: 'Username and password required' });
  }

  try {
    const { rows } = await pool.query(
      `SELECT id, username, password_hash, role, permissions, is_active
       FROM users WHERE LOWER(username) = LOWER($1)`,
      [username.trim()]
    );
    if (rows.length === 0) {
      return res.status(401).json({ error: 'Invalid username or password' });
    }

    const row = rows[0];
    if (row.is_active === false) {
      return res.status(401).json({ error: 'Account is disabled' });
    }

    const valid = await bcrypt.compare(password, row.password_hash);
    if (!valid) {
      return res.status(401).json({ error: 'Invalid username or password' });
    }

    await pool.query(`UPDATE users SET last_login_at = NOW() WHERE id = $1`, [row.id]);

    req.session.userId = row.id;
    req.session.username = row.username;

    const user = {
      id: row.id,
      username: row.username,
      role: row.role,
      permissions: row.permissions || [],
      is_active: true,
    };

    // Ensure the store writes before the response finishes (proxy / HTTPS).
    req.session.save((err) => {
      if (err) {
        console.error('Auth session save error:', err.message);
        return res.status(500).json({ error: 'Login failed' });
      }
      res.json(staffAuthPayload(user));
    });
  } catch (err) {
    console.error('Auth login error:', err.message);
    res.status(500).json({ error: 'Login failed' });
  }
});

router.post('/logout', (req, res) => {
  req.session.destroy((err) => {
    if (err) {
      console.error('Auth logout error:', err.message);
      return res.status(500).json({ error: 'Logout failed' });
    }
    res.clearCookie('gallery.sid');
    res.json({ ok: true });
  });
});

module.exports = router;