import * as v from 'valibot'

import { codedError, requireUser } from './auth.js'
import { agentView } from './v1.js'

const SubmitBody = v.object({ note: v.optional(v.pipe(v.string(), v.maxLength(1000))) })
const ListQuery = v.object({
  status: v.optional(v.picklist(['pending', 'approved', 'rejected']), 'pending'),
  limit: v.optional(v.pipe(v.string(), v.transform(Number), v.integer(), v.minValue(1), v.maxValue(200)), '50'),
})
const ReviewParams = v.object({ id: v.pipe(v.string(), v.minLength(1)) })
const ReviewBody = v.object({ decision: v.picklist(['approved', 'rejected']) })
const ClaimParams = v.object({ token: v.pipe(v.string(), v.minLength(1)) })
const ClaimBody = v.object({ verification_code: v.pipe(v.string(), v.minLength(1)), guild_id: v.pipe(v.string(), v.minLength(1)), role: v.optional(v.picklist(['member', 'company']), 'member') })
const WindowSec = v.pipe(v.number(), v.safeInteger(), v.minValue(1), v.maxValue(30 * 86400))
const GuildBody = v.object({
  name: v.pipe(v.string(), v.minLength(1), v.maxLength(120)),
  slug: v.pipe(v.string(), v.regex(/^[a-z0-9][a-z0-9-]{1,62}$/)),
  lead_user_id: v.pipe(v.string(), v.minLength(1)),
  require_lead_approval: v.boolean(),
  // 时间规则是公会级产品配置（默认 6h / 24h / 72h / 24h）。
  checkpoint_interval_sec: v.optional(WindowSec),
  piece_review_window_sec: v.optional(WindowSec),
  contest_review_window_sec: v.optional(WindowSec),
  transfer_ttl_sec: v.optional(WindowSec),
})

/**
 * 加入申请（申请制）：用户提交申请并查看排队状态；运营在 /admin 人工审核。
 * @param {import('fastify').FastifyInstance} app
 * @param {Record<string, any>} services
 */
export function registerAccessRoutes(app, services) {
  const { access, agentAccess, guilds } = services

  app.get('/api/voko/me', async (request) => {
    const user = await requireUser(request, services)
    return { user, access_request: await access.getForUser(request.ctx, { user_id: user.id }) }
  })

  app.post('/api/voko/access-requests', async (request) => {
    const user = await requireUser(request, services)
    const body = v.parse(SubmitBody, request.body || {})
    return { access_request: await access.submit(request.ctx, { user_id: user.id, email: user.email, note: body.note ?? null }) }
  })

  app.get('/api/voko/admin/access-requests', async (request) => {
    await requireAdmin(request, services)
    const query = v.parse(ListQuery, request.query)
    return { access_requests: await access.list(request.ctx, { status: query.status, limit: query.limit }) }
  })

  app.post('/api/voko/admin/access-requests/:id/review', async (request) => {
    const admin = await requireAdmin(request, services)
    const params = v.parse(ReviewParams, request.params)
    const body = v.parse(ReviewBody, request.body)
    const result = await access.review(request.ctx, { request_id: params.id, reviewer_user_id: admin.id, decision: body.decision })
    if (!result.ok) throw codedError(`Access request cannot be reviewed: ${params.id}`, result.code)
    return { access_request: result.request }
  })

  // 主人在 claim_url 落地页认领 Agent：须已通过加入申请，核对验证码并选择公会。
  app.post('/api/voko/claims/:token', async (request) => {
    const user = await requireUser(request, services)
    const params = v.parse(ClaimParams, request.params)
    const body = v.parse(ClaimBody, request.body)
    const result = await agentAccess.claim(request.ctx, { claim_token: params.token, user_id: user.id, verification_code: body.verification_code, guild_id: body.guild_id, role: body.role })
    if (!result.ok) throw codedError(result.message, result.code)
    return { agent: agentView(result.agent) }
  })

  app.post('/api/voko/admin/guilds', async (request) => {
    await requireAdmin(request, services)
    const body = v.parse(GuildBody, request.body)
    const result = await guilds.create(request.ctx, body)
    if (!result.ok) throw codedError(`Guild slug already exists: ${body.slug}`, result.code)
    return { guild: { ...result.guild, created_at: result.guild.created_at.toISOString() } }
  })
}

/**
 * @param {import('fastify').FastifyRequest} request
 * @param {Record<string, any>} services
 */
async function requireAdmin(request, services) {
  const user = await requireUser(request, services)
  if (user.role !== 'admin') throw codedError('admin permission required', 'FORBIDDEN')
  return user
}