const express = require('express');
const db = require('../db');
const { requireAuth } = require('../auth');
const { resolveActingProfile, findTargetProfile } = require('../lib/account');
const { hasLifeinvaderPermission, decodeBool } = require('../lib/permissions');

const router = express.Router();
router.use(requireAuth);

const PERMISSION_BY_ACTION = {
    verify: 'profile.verify',
    staff: 'profile.staff',
    lock: 'profile.lock',
};

async function writeAudit(account, actorProfile, action, targetType, targetId, reason, payload) {
    await db.insert(
        `INSERT INTO bleeter_audit_logs (actor_char_id, actor_profile_id, action, target_type, target_id, reason, payload)
         VALUES (?, ?, ?, ?, ?, ?, ?)`,
        [account.char_id, actorProfile ? actorProfile.id : null, action, targetType, targetId, reason || null,
         payload ? JSON.stringify(payload) : null]
    );
}

// POST /api/moderation/profile  {profileId, action: verify|staff|lock, targetId}
router.post('/moderation/profile', async (req, res) => {
    const { profile } = await resolveActingProfile(req.account, req.body.profileId);
    const action = String(req.body.action || '').trim();
    const target = await findTargetProfile({ targetId: req.body.targetId }, true);
    if (!profile || !target) return res.status(400).json({ error: 'invalid' });

    const permission = PERMISSION_BY_ACTION[action];
    if (!permission || !(await hasLifeinvaderPermission(db, req.account.char_id, permission))) {
        return res.status(403).json({ error: 'no_lifeinvader_rights' });
    }
    if (action === 'lock' && Number(profile.id) === Number(target.id)) {
        return res.status(400).json({ error: 'cannot_lock_self' });
    }

    if (action === 'verify') {
        const next = !decodeBool(target.is_verified);
        await db.exec('UPDATE bleeter_profiles SET is_verified = ? WHERE id = ?', [next ? 1 : 0, target.id]);
        await writeAudit(req.account, profile, next ? 'profile.verify' : 'profile.unverify', 'profile', target.id, null, { handle: target.handle, is_verified: next });
        return res.json({ ok: true, is_verified: next });
    }
    if (action === 'staff') {
        const next = !decodeBool(target.is_lifeinvader_staff);
        await db.exec('UPDATE bleeter_profiles SET is_lifeinvader_staff = ? WHERE id = ?', [next ? 1 : 0, target.id]);
        await writeAudit(req.account, profile, next ? 'profile.staff.add' : 'profile.staff.remove', 'profile', target.id, null, { handle: target.handle, is_lifeinvader_staff: next });
        return res.json({ ok: true, is_lifeinvader_staff: next });
    }
    if (action === 'lock') {
        const next = !decodeBool(target.is_locked);
        await db.exec('UPDATE bleeter_profiles SET is_locked = ?, locked_reason = ? WHERE id = ?',
            [next ? 1 : 0, next ? 'Lifeinvader moderation' : null, target.id]);
        await writeAudit(req.account, profile, next ? 'profile.lock' : 'profile.unlock', 'profile', target.id, null, { handle: target.handle, is_locked: next });
        return res.json({ ok: true, is_locked: next });
    }
    res.status(400).json({ error: 'unknown_action' });
});

module.exports = router;