import { NextRequest, NextResponse } from 'next/server';
import { supabase } from '@/lib/supabase';
import { ensureAdmin, ensureAuthenticated, getAuthContext } from '@/lib/access-control';

export async function GET(
  request: NextRequest,
  { params }: { params: { id: string } }
) {
  const ctx = await getAuthContext(request);
  const auth = ensureAuthenticated(ctx);
  if (!auth.ok) {
    return NextResponse.json({ error: auth.error }, { status: auth.status });
  }
  if (!ctx!.isAdmin && ctx!.user.id !== params.id) {
    return NextResponse.json({ error: '无权限' }, { status: 403 });
  }

  const { data, error } = await supabase
    .from('users')
    .select('id,name,role,avatar_url,username,created_at,updated_at')
    .eq('id', params.id)
    .maybeSingle();

  if (error) {
    return NextResponse.json({ error: error.message }, { status: 500 });
  }

  if (!data) {
    return NextResponse.json({ error: '用户不存在' }, { status: 404 });
  }

  return NextResponse.json(data);
}

export async function PATCH(
  request: NextRequest,
  { params }: { params: { id: string } }
) {
  const ctx = await getAuthContext(request);
  const auth = ensureAdmin(ctx);
  if (!auth.ok) {
    return NextResponse.json({ error: auth.error }, { status: auth.status });
  }

  const body = await request.json();
  const { name, role, avatar_url, username, password } = body;

  const updateData: Record<string, unknown> = { updated_at: new Date().toISOString() };
  if (name !== undefined) updateData.name = name;
  if (role !== undefined) updateData.role = role;
  if (avatar_url !== undefined) updateData.avatar_url = avatar_url;
  if (username !== undefined) updateData.username = username || null;
  if (password) {
    const { hashPassword } = await import('@/lib/password');
    updateData.password_hash = hashPassword(String(password));
  }

  const { data, error } = await supabase
    .from('users')
    .update(updateData)
    .eq('id', params.id)
    .select('id,name,role,avatar_url,username,created_at,updated_at')
    .single();

  if (error) {
    return NextResponse.json({ error: error.message }, { status: 500 });
  }

  return NextResponse.json(data);
}

export async function DELETE(
  request: NextRequest,
  { params }: { params: { id: string } }
) {
  const ctx = await getAuthContext(request);
  const auth = ensureAdmin(ctx);
  if (!auth.ok) {
    return NextResponse.json({ error: auth.error }, { status: auth.status });
  }

  const { data: user, error: userError } = await supabase
    .from('users')
    .select('id,role')
    .eq('id', params.id)
    .maybeSingle();

  if (userError) {
    return NextResponse.json({ error: userError.message }, { status: 500 });
  }

  if (!user) {
    return NextResponse.json({ error: '用户不存在' }, { status: 404 });
  }

  if (user.role === 'owner') {
    return NextResponse.json({ error: '不能删除老板账号' }, { status: 400 });
  }

  const { error } = await supabase
    .from('users')
    .delete()
    .eq('id', params.id);

  if (error) {
    return NextResponse.json({ error: error.message }, { status: 500 });
  }

  return NextResponse.json({ success: true });
}