// Self-service account security for the logged-in user (any role). Mounted under
// the admin router (so isLoggedIn has already run and req.user is the fresh DB
// row), but NOT behind the admin-only gate — editors manage their own 2FA too.

const users = require('../../../model/users/users.model')
const activity = require('../../../model/activity/activity.model')
const userIdentities = require('../../../model/userIdentities/userIdentities.model')
const totp = require('../../../utils/totp')

const log = require('../../../utils/logger')('account')

// Current user's security status (does not expose the secret).
async function getAccount(req, res) {
  return res.json({
    id: req.user.id,
    username: req.user.username,
    role: req.user.role,
    totp_enabled: Boolean(req.user.totp_enabled),
  })
}

// Step 1: generate a fresh secret (stored but not yet enabled) and return the
// otpauth URL + a QR data URL for the user to scan. Overwrites any pending,
// not-yet-confirmed secret. Refuses if TOTP is already enabled.
async function totpSetup(req, res) {
  try {
    if (req.user.totp_enabled) {
      return res.status(409).json({ message: 'Two-factor is already enabled. Disable it first to re-enroll.' })
    }
    const { base32, otpauthUrl } = totp.generateSecret(req.user.username)
    await users.setTotpSecret(req.user.id, base32)
    const qr = await totp.qrDataUrl(otpauthUrl)
    log.info('totp setup started', { id: req.user.id, username: req.user.username })
    return res.json({ otpauthUrl, qr })
  } catch (err) {
    log.error('totpSetup', err)
    return res.status(500).json({ message: 'Internal Server Error' })
  }
}

// Step 2: confirm one code against the pending secret, then flip totp_enabled on.
async function totpEnable(req, res) {
  try {
    const user = await users.getRawById(req.user.id)
    if (!user || !user.totp_secret) {
      return res.status(400).json({ message: 'Start setup before enabling two-factor.' })
    }
    if (user.totp_enabled) {
      return res.status(409).json({ message: 'Two-factor is already enabled.' })
    }
    if (!totp.verifyCode(user.totp_secret, req.body.code)) {
      return res.status(400).json({ message: 'That code is not valid. Try again.' })
    }
    await users.enableTotp(user.id)
    await activity.log({ req, action: 'account.totp.enable' })
    log.info('totp enabled', { id: user.id, username: user.username })
    return res.json({ totp_enabled: true })
  } catch (err) {
    log.error('totpEnable', err)
    return res.status(500).json({ message: 'Internal Server Error' })
  }
}

// Turn TOTP off. Require a current code to prove the requester still controls the
// authenticator (so a walk-up on an open session can't quietly remove 2FA).
async function totpDisable(req, res) {
  try {
    const user = await users.getRawById(req.user.id)
    if (!user || !user.totp_enabled) {
      return res.status(400).json({ message: 'Two-factor is not enabled.' })
    }
    if (!totp.verifyCode(user.totp_secret, req.body.code)) {
      return res.status(400).json({ message: 'That code is not valid. Try again.' })
    }
    await users.disableTotp(user.id)
    await activity.log({ req, action: 'account.totp.disable' })
    log.info('totp disabled', { id: user.id, username: user.username })
    return res.json({ totp_enabled: false })
  } catch (err) {
    log.error('totpDisable', err)
    return res.status(500).json({ message: 'Internal Server Error' })
  }
}

// ── Linked SSO identities (self-service) ──────────────────────────────────
// List the external accounts (Google/Discord/…) linked to the current user.
// Linking itself happens via the SSO redirect flow (/auth/sso/:provider/link).
async function listIdentities(req, res) {
  try {
    const rows = await userIdentities.listForUser(req.user.id)
    return res.json(rows.map((r) => ({ provider: r.provider, email: r.email, linked_at: r.created_at })))
  } catch (err) {
    log.error('listIdentities', err)
    return res.status(500).json({ message: 'Internal Server Error' })
  }
}

// Remove a linked SSO identity from the current user's account.
async function unlinkIdentity(req, res) {
  const { provider } = req.params
  try {
    const removed = await userIdentities.unlink(req.user.id, provider)
    if (!removed) return res.status(404).json({ message: 'No linked account for that provider.' })
    await activity.log({ req, action: 'auth.sso.unlink', detail: { provider } })
    log.info('sso identity unlinked', { provider, id: req.user.id })
    return res.json({ unlinked: true })
  } catch (err) {
    log.error('unlinkIdentity', err)
    return res.status(500).json({ message: 'Internal Server Error' })
  }
}

module.exports = { getAccount, totpSetup, totpEnable, totpDisable, listIdentities, unlinkIdentity }
