const express = require('express');
const db = require('../db');
const { requireAuth } = require('../auth');
const { resolveActingProfile, findTargetProfile, mapProfile, getAccessibleProfiles } = require('../lib/account');
const { loadProfileDirectory, loadSocial } = require('../lib/queries');
const { canProfileBeBlocked, decodeBool } = require('../lib/permissions');

const router = express.Router();
router.use(requireAuth);

const HANDLE_RE = /^[a-z0-9._-]+$/;

async function acting(req) {
    const profileId = (req.body && req.body.profileId) || req.query.profileId;
    return resolveActingProfile(req.account, profileId);
}

// GET /api/directory?profileId=
router.get('/directory', async (req, res) => {
    const { profile } = await acting(req);
    const profiles = await loadProfileDirectory(profile ? profile.id : 0, false);
    res.json({ profiles });
});

// GET /api/social?profileId=
router.get('/social', async (req, res) => {
    const { profile } = await acting(req);
    if (!profile) return res.json({ following: [], followers: [], blocked: [] });
    res.json(await loadSocial(profile.id));
});

// GET /api/profiles/:handle?profileId=   -> Profil + eigene Posts
router.get('/profiles/:handle', async (req, res) => {
    const { profile: viewer } = await acting(req);
    const viewerId = viewer ? viewer.id : 0;
    const handle = String(req.params.handle || '').toLowerCase();
    const row = await db.q1(
        `SELECT p.*,
                (SELECT COUNT(*) FROM bleeter_follows f WHERE f.followed_profile_id=p.id) AS followers_count,
                (SELECT COUNT(*) FROM bleeter_follows f WHERE f.follower_profile_id=p.id) AS following_count
         FROM bleeter_profiles p WHERE p.handle = ? AND p.is_active = 1`,
        [handle]
    );
    if (!row) return res.status(404).json({ error: 'not_found' });
    const target = mapProfile(row);

    const isFollowing = viewerId ? !!(await db.q1(
        'SELECT 1 FROM bleeter_follows WHERE follower_profile_id = ? AND followed_profile_id = ? LIMIT 1',
        [viewerId, target.id]
    )) : false;
    const isBlocked = viewerId ? !!(await db.q1(
        'SELECT 1 FROM bleeter_blocks WHERE blocker_profile_id = ? AND blocked_profile_id = ? LIMIT 1',
        [viewerId, target.id]
    )) : false;

    const posts = await db.q(
        `SELECT posts.id, posts.feed_type, posts.body, posts.created_at, media.url AS media_url,
                (SELECT COUNT(*) FROM bleeter_likes l WHERE l.target_type='post' AND l.target_id=posts.id) AS likes,
                (SELECT COUNT(*) FROM bleeter_comments c WHERE c.post_id=posts.id AND c.self_deleted_at IS NULL AND c.hidden_at IS NULL AND c.deleted_at IS NULL) AS comments
         FROM bleeter_posts posts
         LEFT JOIN bleeter_media media ON media.id = posts.media_id
         WHERE posts.author_profile_id = ? AND posts.self_deleted_at IS NULL AND posts.hidden_at IS NULL AND posts.deleted_at IS NULL
         ORDER BY posts.created_at DESC LIMIT 50`,
        [target.id]
    );

    res.json({
        profile: target,
        is_following: isFollowing,
        is_blocked: isBlocked,
        posts: posts.map(p => ({
            id: p.id, feed_type: p.feed_type, body: p.body || '', media_url: p.media_url,
            created_at: String(p.created_at || ''), likes: Number(p.likes) || 0, comments: Number(p.comments) || 0,
        })),
    });
});

// POST /api/profiles/:id/follow  {profileId}
router.post('/profiles/:id/follow', async (req, res) => {
    const { profile } = await acting(req);
    const target = await findTargetProfile({ targetId: req.params.id });
    if (!profile || !target) return res.status(400).json({ error: 'invalid' });
    if (Number(profile.id) === Number(target.id)) return res.status(400).json({ error: 'self_follow' });
    await db.exec('INSERT IGNORE INTO bleeter_follows (follower_profile_id, followed_profile_id) VALUES (?, ?)', [profile.id, target.id]);
    res.json({ ok: true });
});

// POST /api/profiles/:id/unfollow  {profileId}
router.post('/profiles/:id/unfollow', async (req, res) => {
    const { profile } = await acting(req);
    const target = await findTargetProfile({ targetId: req.params.id });
    if (!profile || !target) return res.status(400).json({ error: 'invalid' });
    await db.exec('DELETE FROM bleeter_follows WHERE follower_profile_id = ? AND followed_profile_id = ?', [profile.id, target.id]);
    res.json({ ok: true });
});

// POST /api/profiles/:id/block  {profileId}
router.post('/profiles/:id/block', async (req, res) => {
    const { profile } = await acting(req);
    const target = await findTargetProfile({ targetId: req.params.id });
    if (!profile || !target) return res.status(400).json({ error: 'invalid' });
    if (Number(profile.id) === Number(target.id)) return res.status(400).json({ error: 'self_block' });
    if (!canProfileBeBlocked(target.profile_type, target.is_lifeinvader_staff)) return res.status(403).json({ error: 'cannot_block' });
    await db.exec('INSERT IGNORE INTO bleeter_blocks (blocker_profile_id, blocked_profile_id) VALUES (?, ?)', [profile.id, target.id]);
    await db.exec(
        `DELETE FROM bleeter_follows
         WHERE (follower_profile_id=? AND followed_profile_id=?) OR (follower_profile_id=? AND followed_profile_id=?)`,
        [profile.id, target.id, target.id, profile.id]
    );
    res.json({ ok: true });
});

// POST /api/profiles/:id/unblock  {profileId}
router.post('/profiles/:id/unblock', async (req, res) => {
    const { profile } = await acting(req);
    const target = await findTargetProfile({ targetId: req.params.id });
    if (!profile || !target) return res.status(400).json({ error: 'invalid' });
    await db.exec('DELETE FROM bleeter_blocks WHERE blocker_profile_id = ? AND blocked_profile_id = ?', [profile.id, target.id]);
    res.json({ ok: true });
});

// PATCH /api/profile  {profileId, displayName, avatarUrl, bannerUrl, bio}  -> aktives Profil bearbeiten
router.patch('/profile', async (req, res) => {
    const { profile } = await acting(req);
    if (!profile) return res.status(400).json({ error: 'no_profile' });
    if (!profile.can_edit_profile) return res.status(403).json({ error: 'not_allowed' });

    const displayName = String(req.body.displayName || '').trim().slice(0, 80);
    const avatarUrl = String(req.body.avatarUrl || '').trim().slice(0, 255);
    const bannerUrl = String(req.body.bannerUrl || '').trim().slice(0, 255);
    const bioMax = profile.profile_type === 'private' ? 200 : 500;
    const bio = String(req.body.bio || '').trim().slice(0, bioMax);
    if (!displayName) return res.status(400).json({ error: 'name_required' });

    await db.exec(
        'UPDATE bleeter_profiles SET display_name = ?, avatar_url = ?, banner_url = ?, bio = ? WHERE id = ?',
        [displayName, avatarUrl || null, bannerUrl || null, bio, profile.id]
    );
    res.json({ ok: true });
});

// POST /api/register  {handle, displayName}  -> privates Profil anlegen (falls noch keins)
router.post('/register', async (req, res) => {
    const account = req.account;
    let handle = String(req.body.handle || '').trim().toLowerCase();
    let displayName = String(req.body.displayName || '').trim().slice(0, 80);

    if (handle.length < 2 || handle.length > 32) return res.status(400).json({ error: 'invalid_handle_length' });
    if (!HANDLE_RE.test(handle)) return res.status(400).json({ error: 'invalid_handle_chars' });
    if (!displayName) displayName = handle;

    const existingPrivate = await db.q1(
        "SELECT id FROM bleeter_profiles WHERE account_id = ? AND profile_type = 'private' LIMIT 1",
        [account.id]
    );
    if (existingPrivate) return res.status(409).json({ error: 'already_registered' });

    const reserved = await db.q1('SELECT 1 FROM bleeter_reserved_handles WHERE handle = ? LIMIT 1', [handle]);
    if (reserved) return res.status(409).json({ error: 'reserved' });

    const taken = await db.q1('SELECT 1 FROM bleeter_profiles WHERE handle = ? LIMIT 1', [handle]);
    if (taken) return res.status(409).json({ error: 'handle_taken' });

    await db.insert(
        `INSERT INTO bleeter_profiles (account_id, profile_type, handle, display_name, email_contact, bio)
         VALUES (?, 'private', ?, ?, ?, '')`,
        [account.id, handle, displayName, account.mail_address]
    );

    const profiles = await getAccessibleProfiles(account);
    res.json({ ok: true, profiles });
});

module.exports = router;