import { NextResponse } from "next/server";
import { createClient } from "@supabase/supabase-js";
import { cookies } from "next/headers";
import { createRouteHandlerClient } from "@supabase/auth-helpers-nextjs";
import { sendInvitationWithActivationEmail } from "@/lib/emailMigrationHelpers";
import { getUserPermissions, canCreateUserWithRole } from "@/lib/permissions";

// Types de rôles autorisés (alignés avec public.role)
const ROLES = ["SUPER_ADMIN","ADMIN","AGENT","COMPTA"] as const;
type Role = typeof ROLES[number];

export async function POST(req: Request) {
  console.log("🚀 [API] /api/access/nouveau - Début de la requête");
  
  try {
    const body = await req.json();
    console.log("📝 [API] Body reçu:", { 
      email: body.email, 
      firstName: body.firstName, 
      orgId: body.orgId, 
      role: body.role 
    });

    const email = String(body.email || "").trim().toLowerCase();
    const firstName = String(body.firstName || "").trim();
    const requestedOrgId = String(body.orgId || "").trim();
    const requestedRole = String(body.role || "").trim().toUpperCase() as Role;

    if (!email || !requestedRole || !ROLES.includes(requestedRole)) {
      console.log("❌ [API] Validation échouée - données invalides");
      return NextResponse.json({ error: "invalid_input" }, { status: 400 });
    }

    // Client Supabase pour l'authentification
    const sb = createRouteHandlerClient({ cookies });
    const { data: { user } } = await sb.auth.getUser();
    
    if (!user) {
      console.log("❌ [API] Utilisateur non authentifié");
      return NextResponse.json({ error: "unauthorized" }, { status: 401 });
    }

    console.log("✅ [API] Utilisateur authentifié:", user.email);

    // Vérifier les permissions (simplifié pour le debug)
    let targetOrgId = requestedOrgId;
    
    // Si pas d'orgId fourni, essayer de récupérer via organization_members
    if (!targetOrgId) {
      // Récupérer l'organisation via requête directe
      const { data: memberData } = await sb
      .from("organization_members")
      .select(`
        organization:organizations(id, name, structure_api)
      `)
        .eq("user_id", user.id)
        .eq("revoked", false)
          .maybeSingle();
          
        if (memberData?.organization) {
          const org = memberData.organization as any;
          targetOrgId = org.id;
        }
    }

    // If still not found, and user is staff, try staff_settings.active_org_id
    if (!targetOrgId) {
      try {
        const { data: staffRow } = await sb.from('staff_users').select('is_staff').eq('user_id', user.id).maybeSingle();
        const isStaff = !!staffRow?.is_staff;
        if (isStaff) {
          const { data: ss } = await sb.from('staff_settings').select('active_org_id').eq('user_id', user.id).maybeSingle();
          if (ss?.active_org_id) targetOrgId = ss.active_org_id;
        }
      } catch {}
    }

    if (!targetOrgId) {
      console.log("❌ [API] Aucune organisation trouvée");
      return NextResponse.json({ error: "org_missing" }, { status: 400 });
    }

    // Vérifier que l'organisation existe
    const { data: org } = await sb
      .from("organizations")
      .select("id,name,structure_api")
      .eq("id", targetOrgId)
      .maybeSingle();
      
    if (!org) {
      console.log("❌ [API] Organisation non trouvée");
      return NextResponse.json({ error: "org_not_found" }, { status: 404 });
    }

    console.log("🏛️ [API] Organisation trouvée:", org.name);

    // Vérification des permissions: empêcher AGENT/COMPTA de créer des utilisateurs
    // et empêcher ADMIN de créer un SUPER_ADMIN
    const permissions = await getUserPermissions(sb);
    if (!permissions) {
      return NextResponse.json({ error: "unauthorized" }, { status: 401 });
    }
    
    if (!canCreateUserWithRole(permissions, requestedRole as any)) {
      console.log("❌ [API] Permission refusée: impossible de créer un utilisateur", requestedRole);
      return NextResponse.json({ error: "forbidden", message: "Vous n'avez pas la permission de créer cet utilisateur" }, { status: 403 });
    }

    // Client admin Supabase (service role)
    const admin = createClient(
      process.env.NEXT_PUBLIC_SUPABASE_URL!,
      process.env.SUPABASE_SERVICE_ROLE_KEY!,
      { auth: { autoRefreshToken: false, persistSession: false } }
    );

    console.log("🔗 [API] Création utilisateur vérifié...");
    const origin = process.env.NEXT_PUBLIC_BASE_URL || "http://localhost:3000";
    const signinUrl = `${origin}/signin`;

    const metadata = {
      first_name: firstName || null,
      role: requestedRole,
      org_id: org.id,
      org_name: org.name,
      structure_api: org.structure_api ?? null,
    };

    // Vérifier si utilisateur déjà existant (RPC utilitaire find_user_by_email)
    const { data: existingUserRow } = await admin
      .rpc("find_user_by_email", { email_param: email })
      .maybeSingle();

    let newUserId: string | undefined = (existingUserRow as any)?.id;

    if (newUserId) {
      await admin.auth.admin.updateUserById(newUserId, {
        email_confirm: true,
        user_metadata: { ...(((existingUserRow as any)?.user_metadata) || {}), ...metadata },
      });
    } else {
      const { data: createData, error: createError } = await admin.auth.admin.createUser({
        email,
        email_confirm: true,
        user_metadata: metadata,
      });

      if (createError || !createData?.user?.id) {
        console.log("❌ [API] Erreur création utilisateur:", createError);
        return NextResponse.json({ error: "create_failed", message: createError?.message }, { status: 400 });
      }
      newUserId = createData.user.id;
    }

    console.log("✅ [API] Utilisateur prêt:", { userId: newUserId, email });

    // Attacher l'adhésion à l'organisation
    console.log("👥 [API] Création de l'adhésion à l'organisation...");
    const { error: memberErr } = await admin
      .from("organization_members")
      .upsert({ org_id: org.id, user_id: newUserId, role: requestedRole, revoked: false }, { onConflict: "org_id,user_id" });
      
    if (memberErr) {
      console.log("❌ [API] Erreur lors de la création de l'adhésion:", memberErr);
      return NextResponse.json({ error: "attach_failed", message: memberErr.message }, { status: 400 });
    }
    
    console.log("✅ [API] Adhésion créée avec succès");

    // Envoyer l'email via le système universel
    console.log("📧 [API] Envoi de l'email de confirmation via le système universel...");
    // Récupérer le rôle du créateur dans l'organisation (si disponible)
    let inviterStatus: string | undefined = undefined;
    try {
      const { data: inviterMember } = await sb
        .from('organization_members')
        .select('role')
        .eq('org_id', org.id)
        .eq('user_id', user.id)
        .maybeSingle();
      inviterStatus = (inviterMember as any)?.role || undefined;
    } catch {}

    const inviterName = (user.user_metadata as any)?.first_name || user.email || 'Administrateur';

    await sendInvitationWithActivationEmail(email, {
      firstName,
      organizationName: org.name,
      activationUrl: signinUrl,
      role: requestedRole,
      inviterName,
      inviterStatus,
    });

    // Configurer les préférences d'authentification
    await admin
      .from("user_auth_prefs")
      .upsert({ user_id: newUserId, allow_magic_link: true, allow_password: false });

    const responsePayload = {
      ok: true,
      user_id: newUserId,
      email,
      org: { id: org.id, name: org.name, structure_api: org.structure_api },
      role: requestedRole,
    };
    
    console.log("🎉 [API] Succès - Réponse:", responsePayload);
    return NextResponse.json(responsePayload);
    
  } catch (e: any) {
    console.error("💥 [API] Erreur critique:", {
      message: e?.message,
      stack: e?.stack?.split('\n')[0]
    });
    return NextResponse.json({ error: "server_error", message: e?.message || "Internal Server Error" }, { status: 500 });
  }
}