'use strict';

const crypto = require('crypto');
const express = require('express');
const ldapClient = require('./ldapClient');
const adminSettings = require('./adminSettings');

const router = express.Router();

function timingSafeEqualStr(a, b) {
  const ba = Buffer.from(String(a || ''));
  const bb = Buffer.from(String(b || ''));
  if (ba.length !== bb.length) return false;
  return crypto.timingSafeEqual(ba, bb);
}

function apiKeyFromRequest(req) {
  const header = String(req.headers['x-api-key'] || '');
  if (header) return header;
  return String(req.query.api_key || '');
}

function requireApiKey(req, res, next) {
  const expected = adminSettings.getSettings().apiKey;
  if (!expected) {
    return res.status(503).json({
      success: false,
      error: 'API-ключ не настроен — сгенерируйте его в панели администратора'
    });
  }
  const provided = apiKeyFromRequest(req);
  if (!provided || !timingSafeEqualStr(provided, expected)) {
    return res.status(401).json({ success: false, error: 'Неверный или отсутствующий API-ключ' });
  }
  next();
}

router.get('/users', requireApiKey, async (req, res) => {
  try {
    const users = await ldapClient.listUsers();
    res.json({
      success: true,
      count: users.length,
      users: users.map((u) => ({
        login: u.login,
        fio: u.full_name,
        position: u.position,
        phone: u.phone,
        email: u.email
      }))
    });
  } catch (err) {
    const status = err.status || 500;
    res.status(status).json({ success: false, error: status >= 500 ? 'Внутренняя ошибка сервера' : (err.message || 'Ошибка') });
  }
});

module.exports = router;