import type { FastifyInstance } from 'fastify';
import { config } from '../config.js';
import {
  createSessionCookie,
  requireAdminAuth,
  sessionCookieOptions,
  verifyAdminPassword,
  verifySessionCookie,
} from '../middleware/auth.js';
import { loginSchema, pairingRedeemSchema } from '../schemas.js';
import { extensionAuthService } from '../services/intake.service.js';

export async function authRoutes(app: FastifyInstance): Promise<void> {
  app.post('/api/auth/login', async (request, reply) => {
    const body = loginSchema.parse(request.body);
    if (body.username !== config.adminUsername || !verifyAdminPassword(body.password)) {
      return reply.code(401).send({ error: 'invalid_credentials' });
    }
    const session = createSessionCookie(body.username);
    reply.setCookie('tg_session', session, sessionCookieOptions());
    return { ok: true };
  });

  app.post('/api/auth/logout', async (_request, reply) => {
    reply.clearCookie('tg_session', { path: '/' });
    return { ok: true };
  });

  app.get('/api/auth/me', async (request, reply) => {
    if (!verifySessionCookie(request.cookies.tg_session)) {
      return reply.code(401).send({ error: 'unauthorized' });
    }
    return { user: config.adminUsername };
  });

  app.post('/api/extension/pairing', { preHandler: requireAdminAuth }, async () => {
    return extensionAuthService.createPairingCode();
  });

  app.get('/api/extension/tokens', { preHandler: requireAdminAuth }, async () => {
    return extensionAuthService.listTokens();
  });

  app.delete('/api/extension/tokens/:id', { preHandler: requireAdminAuth }, async (request) => {
    const { id } = request.params as { id: string };
    extensionAuthService.revokeToken(id);
    return { ok: true };
  });

  app.post('/api/extension/pair', async (request, reply) => {
    const body = pairingRedeemSchema.parse(request.body);
    const result = extensionAuthService.redeemPairingCode(body.code, body.label);
    if (!result) {
      return reply.code(400).send({ error: 'invalid_or_expired_code' });
    }
    return {
      token: result.token,
      token_id: result.id,
      api_base_url: config.publicBaseUrl,
    };
  });
}