// lib/directus.ts
// Central Directus helpers used by API routes. (user bearer only)

// ⚠️ NOTE: Do NOT import `headers()` / `cookies()` from "next/headers" here.
// Next 15's types can make those async and break build-time type checks in shared libs.

const BASE = (
  process.env.DIRECTUS_URL ||
  process.env.NEXT_PUBLIC_API_BASE_URL ||
  ""
).replace(/\/$/, "");
// DIRECTUS_TOKEN_ADMIN_REGISTER is the canonical credential for the production
// Registration Bot policy. Keep older aliases as independently tested fallbacks:
// a configured but stale token must not hide a later valid credential.
const REGISTRATION_CREDENTIALS = [
  ["DIRECTUS_TOKEN_ADMIN_REGISTER", process.env.DIRECTUS_TOKEN_ADMIN_REGISTER],
  ["DIRECTUS_SERVICE_TOKEN", process.env.DIRECTUS_SERVICE_TOKEN],
  ["DIRECTUS_ADMIN_TOKEN", process.env.DIRECTUS_ADMIN_TOKEN],
].filter(
  (entry, index, entries): entry is [string, string] =>
    Boolean(entry[1]) && entries.findIndex((other) => other[1] === entry[1]) === index
);
const ROLE_MEMBER_NAME = process.env.DIRECTUS_ROLE_MEMBER_NAME || "Users";
const PROJECTS_COLLECTION = process.env.DIRECTUS_PROJECTS_COLLECTION || "projects";

if (!BASE) console.warn("[directus] Missing DIRECTUS_URL / NEXT_PUBLIC_API_BASE_URL");
if (!REGISTRATION_CREDENTIALS.length)
  console.warn(
    "[directus] Missing DIRECTUS_TOKEN_ADMIN_REGISTER (or legacy service-token alias) " +
      "used for registration and username login"
  );

export function bytesFromMB(mb: number) {
  return Math.round(mb * 1024 * 1024);
}

/**
 * Return the user's Directus bearer token from the **incoming Request**.
 * Looks at:
 *  1) Authorization: Bearer ...
 *  2) Raw Cookie header for ma_at / ma_at_beta / ma_session
 *
 * We intentionally avoid `next/headers` helpers here to keep this library
 * compatible with Next 15's stricter type checks.
 */
export function getUserBearerFromRequest(req?: Request): string | null {
  if (!req) return null;

  // 1) Authorization header (supports server-to-server/proxy calls)
  const hAuth = req.headers.get("authorization");
  if (hAuth?.startsWith("Bearer ")) return hAuth.slice(7);

  // 2) Raw Cookie header (plain Request)
  const raw = req.headers.get("cookie") ?? "";
  if (raw) {
    const map = Object.fromEntries(
      raw.split(/;\s*/).map((p) => {
        const [k, ...v] = p.split("=");
        return [decodeURIComponent(k), decodeURIComponent(v.join("=") || "")];
      })
    );
    const t = map["ma_at"] || map["ma_at_beta"] || map["ma_session"];
    if (t) return String(t);
  }

  return null;
}

// ─────────────────────────────────────────────────────────────
// Low-level helpers (bearer REQUIRED; no fallbacks)
// ─────────────────────────────────────────────────────────────

function authHeaders(bearer: string, extra?: HeadersInit): HeadersInit {
  return { Accept: "application/json", Authorization: `Bearer ${bearer}`, ...extra };
}

async function parseJsonSafe(res: Response) {
  const text = await res.text();
  let json: any = null;
  try {
    json = text ? JSON.parse(text) : null;
  } catch {}
  return { json, text };
}

async function throwIfNotOk(res: Response) {
  const { json, text } = await parseJsonSafe(res);
  if (!res.ok) {
    const err: any = new Error(`Directus ${res.status}: ${text || res.statusText}`);
    err.status = res.status;
    err.detail = json ?? text;
    throw err;
  }
  return json;
}

export async function dxGET<T = any>(path: string, bearer: string): Promise<T> {
  const res = await fetch(`${BASE}${path}`, {
    headers: authHeaders(bearer),
                          cache: "no-store",
  });
  return (await throwIfNotOk(res)) as T;
}

export async function dxPOST<T = any>(path: string, bearer: string, body: any): Promise<T> {
  const res = await fetch(`${BASE}${path}`, {
    method: "POST",
    headers: authHeaders(bearer, { "content-type": "application/json" }),
                          body: JSON.stringify(body),
                          cache: "no-store",
  });
  return (await throwIfNotOk(res)) as T;
}

export async function dxPATCH<T = any>(path: string, bearer: string, body: any): Promise<T> {
  const res = await fetch(`${BASE}${path}`, {
    method: "PATCH",
    headers: authHeaders(bearer, { "content-type": "application/json" }),
                          body: JSON.stringify(body),
                          cache: "no-store",
  });
  return (await throwIfNotOk(res)) as T;
}

export async function dxDELETE<T = any>(path: string, bearer: string): Promise<T> {
  const res = await fetch(`${BASE}${path}`, {
    method: "DELETE",
    headers: authHeaders(bearer),
                          cache: "no-store",
  });
  return (await throwIfNotOk(res)) as T;
}

// ─────────────────────────────────────────────────────────────
// Server-only admin fetch (registration flows, etc.)
// ─────────────────────────────────────────────────────────────

export async function directusAdminFetch<T = any>(path: string, init?: RequestInit): Promise<T> {
  if (!BASE) throw new Error("Missing Directus base URL");
  if (!REGISTRATION_CREDENTIALS.length) throw new Error("Missing Directus registration credential");

  let lastAuthorizationError: any = null;
  for (const [credentialName, credential] of REGISTRATION_CREDENTIALS) {
    const res = await fetch(`${BASE}${path}`, {
      ...init,
      headers: {
        Accept: "application/json",
        Authorization: `Bearer ${credential}`,
        ...(init?.headers || {}),
      },
      cache: "no-store",
    });

    try {
      return (await throwIfNotOk(res)) as T;
    } catch (error: any) {
      if (error?.status !== 401 && error?.status !== 403) throw error;
      lastAuthorizationError = error;
      console.warn(`[directus] Registration credential rejected: ${credentialName}`, {
        status: error.status,
        code: error?.detail?.errors?.[0]?.extensions?.code,
      });
    }
  }

  throw lastAuthorizationError ?? new Error("No authorized Directus registration credential");
}

// ─────────────────────────────────────────────────────────────
// Files & items — user bearer ONLY (no folder listing/browsing)
// ─────────────────────────────────────────────────────────────

export async function uploadFile(
  file: Blob | File,
  filename: string,
  bearer: string,
  options?: { folderId?: string; title?: string }
): Promise<{ id: string }> {
  const form = new FormData();
  form.set("file", file, filename);
  form.set("filename_download", filename);
  if (options?.title) form.set("title", options.title);
  if (options?.folderId) form.set("folder", options.folderId); // user-scoped

  const res = await fetch(`${BASE}/files`, {
    method: "POST",
    headers: authHeaders(bearer),
                          body: form,
                          cache: "no-store",
  });

  const json = await throwIfNotOk(res);
  const id = json?.data?.id ?? json?.id;
  if (!id) throw new Error("File upload succeeded but no id returned");
  return { id: String(id) };
}

export async function createSettingsItem(
  collection: string,
  payload: any,
  bearer: string
): Promise<{ data: { id: string } }> {
  // Note: callers are already using { data: ... } patterns when needed.
  return dxPOST<{ data: { id: string } }>(`/items/${collection}`, bearer, payload);
}

export async function createProjectRow(
  payload: any,
  bearer: string
): Promise<{ data: { id: string } }> {
  return dxPOST<{ data: { id: string } }>(`/items/${PROJECTS_COLLECTION}`, bearer, payload);
}

export async function patchProject(
  id: string | number,
  payload: any,
  bearer: string
): Promise<{ data: { id: string } }> {
  return dxPATCH<{ data: { id: string } }>(`/items/${PROJECTS_COLLECTION}/${id}`, bearer, payload);
}

// ─────────────────────────────────────────────────────────────
/** Auth helpers (registration / login support) */
// ─────────────────────────────────────────────────────────────

export async function resolveMemberRoleId(): Promise<string> {
  const name = ROLE_MEMBER_NAME;
  const q = `/roles?filter[name][_eq]=${encodeURIComponent(name)}&fields=id,name&limit=1`;
  const { data } = await directusAdminFetch<{ data: Array<{ id: string }> }>(q);
  const hit = data?.[0]?.id;
  if (!hit) throw new Error(`Role not found: ${name}`);
  return hit;
}

/** Registrations always create a 'Users' role account. No overrides. */
export async function createDirectusUser(input: {
  username: string;
  password: string;
  email?: string;
}): Promise<{ id: string }> {
  const role = await resolveMemberRoleId();

  // If email is omitted, create a stable placeholder so login can still work.
  const email =
  input.email && input.email.trim()
  ? input.email.trim()
  : `${input.username}@noemail.local`;

  // System endpoint `/users` expects raw fields (no { data } wrapper).
  const res = await directusAdminFetch<{ data?: { id?: string } }>(`/users`, {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({
      status: "active",
      role,
      username: input.username,
      email,
      password: input.password,
    }),
  });

  const id = res?.data?.id as string | undefined;
  if (!id) throw new Error("User create succeeded but no id returned");
  return { id: String(id) };
}

export async function emailForUsername(username: string): Promise<string | null> {
  const clean = username.trim();
  if (!clean) return null;
  const q = `/users?filter[username][_eq]=${encodeURIComponent(clean)}&fields=email&limit=1`;
  const { data } = await directusAdminFetch<{ data: Array<{ email?: string }> }>(q);
  const em = data?.[0]?.email;
  return em ? String(em) : null;
}

export async function directusUserExists(email: string, username: string): Promise<boolean> {
  const q =
    `/users?filter[_or][0][email][_eq]=${encodeURIComponent(email)}` +
    `&filter[_or][1][username][_eq]=${encodeURIComponent(username)}` +
    `&fields=id&limit=1`;
  const { data } = await directusAdminFetch<{ data: Array<{ id: string }> }>(q);
  return Array.isArray(data) && data.length > 0;
}

export async function loginDirectus(email: string, password: string) {
  if (!BASE) throw new Error("Missing Directus base URL");
  const res = await fetch(`${BASE}/auth/login`, {
    method: "POST",
    headers: { Accept: "application/json", "Content-Type": "application/json" },
    body: JSON.stringify({ email, password }),
                          cache: "no-store",
  });
  const json = await throwIfNotOk(res);
  // Directus typically returns { data: { access_token, refresh_token, expires } }
  return json?.data ?? json;
}