const express = require('express');
const bcrypt = require('bcryptjs');
const db = require('../db');
const { sign, requireAuth } = require('../auth');
const { getAccessibleProfiles } = require('../lib/account');
const { hasLifeinvaderPermission } = require('../lib/permissions');

const router = express.Router();

function publicAccount(account) {
    return {
        id: account.id,
        char_id: account.char_id,
        mail_address: account.mail_address,
        phone_number: account.phone_number,
    };
}

// Login mit Handle ODER Mail + ingame gesetztem Bleeter-Passwort
router.post('/login', async (req, res) => {
    try {
        const login = String((req.body && req.body.login) || '').trim().toLowerCase();
        const password = String((req.body && req.body.password) || '');
        if (!login || !password) return res.status(400).json({ error: 'missing_credentials' });

        let account = null;
        if (login.includes('@')) {
            account = await db.q1('SELECT * FROM bleeter_accounts WHERE mail_address = ?', [login]);
        } else {
            const profile = await db.q1('SELECT account_id FROM bleeter_profiles WHERE handle = ? LIMIT 1', [login]);
            if (profile && profile.account_id) {
                account = await db.q1('SELECT * FROM bleeter_accounts WHERE id = ?', [profile.account_id]);
            }
        }

        if (!account || !account.web_password_hash) {
            return res.status(401).json({ error: 'invalid_login' });
        }
        if (account.status && account.status !== 'active') {
            return res.status(403).json({ error: 'account_disabled' });
        }

        const ok = await bcrypt.compare(password, account.web_password_hash);
        if (!ok) return res.status(401).json({ error: 'invalid_login' });

        const token = sign(account);
        const profiles = await getAccessibleProfiles(account);
        res.json({ token, account: publicAccount(account), profiles });
    } catch (err) {
        console.error('[bleeter] login error', err);
        res.status(500).json({ error: 'server_error' });
    }
});

// Aktueller Account + zugaengliche Profile + Moderationsflag
router.get('/me', requireAuth, async (req, res) => {
    const profiles = await getAccessibleProfiles(req.account);
    const canModerate =
        (await hasLifeinvaderPermission(db, req.account.char_id, 'profile.verify')) ||
        (await hasLifeinvaderPermission(db, req.account.char_id, 'profile.staff')) ||
        (await hasLifeinvaderPermission(db, req.account.char_id, 'profile.lock'));
    res.json({ account: publicAccount(req.account), profiles, can_moderate: canModerate });
});

module.exports = router;