import { parseCookies } from "@/utils/cookieParser";
import { decode } from "jsonwebtoken";
import type { DecodedRole, RolePrivilegeType } from "./features/types";

export const FEATURE_SLUGS = {
  members: "members",
  bookings: "bookings",
  membershipClubs: "membership-clubs",
  accountTypes: "account-types",
  chargeCenters: "charge-centers",
  userManagement: "user-management",
  roleManagement: "role-management",
  accountStatus: "account-status",
  notifications: "notifications",
  chatbotAgents: "chatbot-agents",
  chatbotPrompts: "chatbot-prompts",
  promoCodes: "promo-codes",
  hotDeals: "hot-deals",
  edm: "edm",
  promoCodeCampaigns: "promo-code-campaigns",
  resorts: "resorts",
  memberOffers: "member-offers",
  adminLogs: "admin-logs",
  dashboard: "dashboard",
  campaignReports: "campaign-reports",
  promocodeAccessList: "promocode-access-list",
  kcgm: "kcgm",
  eventAnalytics: "event-analytics",
  // The member module has no sub-slugs on purpose: roles grant "members", and
  // everything inside it comes from the module's own access table — see
  // lib/features/members/access.ts. This one governs who may hand that out.
  memberAccessList: "member-access-list",
};

export const isDevInstance = (request: Request): boolean => {
  const host = request.headers.get("host") ?? new URL(request.url).hostname;
  return host.includes("dev.console2.karmagroup");
};

export const checkAccess = (
  request: Request,
  scopeType: RolePrivilegeType,
  featureSlug: string,
) => {
  const cookieHeader = request.headers.get("Cookie");
  const tokens = parseCookies(cookieHeader ?? "");
  if (!tokens.admin_scopes) {
    return false;
  }
  const decoded = decode(tokens.admin_scopes) as {
    scopes: DecodedRole[];
    super_admin: boolean;
  } | null;
  if (decoded?.super_admin) {
    return true;
  }
  if (decoded?.scopes) {
    let hasAccess = false;
    decoded.scopes.forEach((item) => {
      if (item.feature_slug === featureSlug && item[scopeType]) {
        hasAccess = true;
      }
    });
    return hasAccess;
  }
  return false;
};

export const isSuperAdminAccess = (request: Request) => {
  const cookieHeader = request.headers.get("Cookie");
  const tokens = parseCookies(cookieHeader ?? "");
  if (!tokens.admin_scopes) {
    return false;
  }
  const decoded = decode(tokens.admin_scopes) as {
    super_admin: boolean;
  } | null;
  return decoded?.super_admin === true;
};

// Canonical sidebar module order — keep in sync with console.navigations.tsx.
// Used to pick a landing route for users without dashboard access.
const NAV_ACCESS_ORDER: { href: string; featureSlugs: string[] }[] = [
  { href: "/admin/dashboard", featureSlugs: ["dashboard"] },
  { href: "/admin/members", featureSlugs: ["members"] },
  { href: "/admin/bookings", featureSlugs: ["bookings"] },
  {
    href: "/admin/memberships/account-types",
    featureSlugs: ["account-types", "membership-clubs", "charge-centers"],
  },
  { href: "/admin/notifications", featureSlugs: ["notifications"] },
  {
    href: "/admin/chatbot",
    featureSlugs: ["chatbot-agents", "chatbot-prompts"],
  },
  {
    href: "/admin/promo-code-campaigns",
    featureSlugs: ["promo-code-campaigns"],
  },
  {
    href: "/admin/promo-codes",
    featureSlugs: ["promo-codes"],
  },
  {
    href: "/admin/kcgm",
    featureSlugs: ["kcgm"],
  },
  { href: "/admin/edm", featureSlugs: ["edm"] },
  { href: "/admin/resorts", featureSlugs: ["resorts"] },
  { href: "/admin/member-offers", featureSlugs: ["member-offers"] },
  { href: "/admin/activity-logs", featureSlugs: ["admin-logs"] },
  { href: "/admin/points-transfer", featureSlugs: ["points-transfer"] },
  { href: "/admin/my-points", featureSlugs: ["my-points"] },
  { href: "/admin/event-analytics", featureSlugs: ["event-analytics"] },
];

// Returns the first module (in sidebar order) the user has read access to,
// or null if they have access to nothing.
export const getFirstAccessibleRoute = (request: Request): string | null => {
  for (const item of NAV_ACCESS_ORDER) {
    if (item.featureSlugs.some((slug) => checkAccess(request, "read", slug))) {
      return item.href;
    }
  }
  return null;
};

export const getCheckedAccess = (request: Request, featureSlug: string) => {
  const cookieHeader = request.headers.get("Cookie");
  const tokens = parseCookies(cookieHeader ?? "");
  if (!tokens.admin_scopes) {
    return {
      create: false,
      read: false,
      update: false,
      delete: false,
      superAdmin: false,
    };
  }
  const decoded = decode(tokens.admin_scopes) as {
    scopes: DecodedRole[];
    super_admin: boolean;
  };
  let scope = {
    create: false,
    read: false,
    update: false,
    delete: false,
    superAdmin: false,
  };
  if (decoded.super_admin === true) {
    scope = {
      create: true,
      read: true,
      update: true,
      delete: true,
      superAdmin: true,
    };
  } else if (!decoded.scopes) {
    scope = {
      create: false,
      read: false,
      update: false,
      delete: false,
      superAdmin: false,
    };
  } else {
    for (const i of ["create", "read", "update", "delete"]) {
      const el = i as keyof DecodedRole;
      decoded.scopes.forEach((item) => {
        if (item.feature_slug === featureSlug && item[el]) {
          scope = {
            ...scope,
            [el]: true,
          };
        }
      });
    }
  }
  return scope;
};