import type { Access, CollectionConfig } from 'payload'

import { adminOnly, adminOnlyAdmin, adminOnlyField, hasRole } from '../../access/roles'
import { logCollectionChange, logCollectionDelete } from '@/hooks/auditLog'
import {
  markPasswordChangeForAlert,
  markResetPasswordForAlert,
  sendPasswordChangeAlert,
  sendResetPasswordAlert,
} from '@/hooks/passwordChangeAlert'

export const Users: CollectionConfig = {
  slug: 'users',
  access: {
    admin: adminOnlyAdmin,
    create: (async ({ req }) => {
      if (hasRole(req.user, ['admin'])) return true
      const existing = await req.payload.find({
        collection: 'users',
        limit: 1,
        overrideAccess: true,
      })
      return existing.totalDocs === 0
    }) as Access,
    delete: adminOnly,
    read: adminOnly,
    update: adminOnly,
  },
  admin: {
    defaultColumns: ['name', 'email'],
    useAsTitle: 'name',
  },
  auth: true,
  fields: [
    {
      name: 'name',
      type: 'text',
    },
    {
      name: 'roles',
      type: 'select',
      hasMany: true,
      options: [
        { label: 'Admin', value: 'admin' },
        { label: 'Editor', value: 'editor' },
        { label: 'Viewer', value: 'viewer' },
      ],
      defaultValue: ['viewer'],
      required: true,
      saveToJWT: true,
      access: {
        update: adminOnlyField,
      },
    },
  ],
  timestamps: true,
  hooks: {
    beforeOperation: [markResetPasswordForAlert],
    beforeChange: [markPasswordChangeForAlert],
    afterChange: [sendPasswordChangeAlert, logCollectionChange('users')],
    afterOperation: [sendResetPasswordAlert],
    afterDelete: [logCollectionDelete('users')],
  },
}