'use strict';

const express = require('express');
const ldapClient = require('./ldapClient');
const config = require('./config');
const sessions = require('./sessions');

const router = express.Router();

function errorResponse(res, err) {
  const status = err.status || 500;
  res.status(status).json({ success: false, error: err.message || 'Внутренняя ошибка сервера' });
}

function getToken(req) {
  const header = req.headers.authorization || '';
  if (header.startsWith('Bearer ')) return header.slice(7);
  return null;
}

function requireAuth(req, res, next) {
  const session = sessions.getSession(getToken(req));
  if (!session) {
    return res.status(401).json({ success: false, error: 'Требуется авторизация' });
  }
  req.session = session;
  next();
}

router.post('/login', async (req, res) => {
  const { username, password } = req.body || {};
  if (!username || !password) {
    return res.status(400).json({ success: false, error: 'Логин и пароль обязательны' });
  }
  if (!config.adminLogin || !config.adminPassword) {
    return res.status(500).json({ success: false, error: 'Учётные данные администратора не заданы в .env (ADMIN_LOGIN/ADMIN_PASSWORD)' });
  }
  const adminAliases = new Set(
    ldapClient.buildBindNames(config.adminLogin).map((n) => n.toLowerCase())
  );
  adminAliases.add(config.adminLogin.split('@')[0].split('\\').pop().toLowerCase());
  if (!adminAliases.has(String(username).toLowerCase())) {
    return res.status(401).json({ success: false, error: 'Доступ разрешён только администратору' });
  }
  try {
    const info = await ldapClient.authenticate(username, password, 'basic');
    const token = sessions.createSession({
      username: info.username,
      full_name: info.full_name,
      groups: info.groups
    });
    res.json({ success: true, token, user: { username: info.username, full_name: info.full_name } });
  } catch (err) {
    return errorResponse(res, err);
  }
});

router.post('/logout', requireAuth, (req, res) => {
  sessions.destroySession(getToken(req));
  res.json({ success: true });
});

router.get('/me', requireAuth, (req, res) => {
  res.json({ success: true, user: req.session.user });
});

router.get('/ous', requireAuth, async (req, res) => {
  try {
    const ous = await ldapClient.listOUs();
    res.json({ success: true, ous });
  } catch (err) {
    errorResponse(res, err);
  }
});

router.get('/groups', requireAuth, async (req, res) => {
  try {
    const groups = await ldapClient.listGroups();
    res.json({ success: true, groups });
  } catch (err) {
    errorResponse(res, err);
  }
});

router.get('/users', requireAuth, async (req, res) => {
  try {
    const users = await ldapClient.listUsers();
    res.json({ success: true, users });
  } catch (err) {
    errorResponse(res, err);
  }
});

router.get('/users/:login', requireAuth, async (req, res) => {
  try {
    const user = await ldapClient.getUser(req.params.login);
    res.json({ success: true, user });
  } catch (err) {
    errorResponse(res, err);
  }
});

router.post('/users', requireAuth, async (req, res) => {
  const { ouDn, fio, login, password, email, phone, groupCNs } = req.body || {};
  if (!login || !fio) {
    return res.status(400).json({ success: false, error: 'ФИО и логин обязательны' });
  }
  try {
    const result = await ldapClient.createUser({ ouDn, fio, login, password, email, phone, groupCNs });
    res.json(result);
  } catch (err) {
    errorResponse(res, err);
  }
});

router.put('/users/:login', requireAuth, async (req, res) => {
  const { fio, email, phone, password, groupCNs } = req.body || {};
  try {
    const result = await ldapClient.updateUser(req.params.login, { fio, email, phone, password, groupCNs });
    res.json(result);
  } catch (err) {
    errorResponse(res, err);
  }
});

router.post('/users/:login/disable', requireAuth, async (req, res) => {
  try {
    const result = await ldapClient.setUserEnabled(req.params.login, false);
    res.json(result);
  } catch (err) {
    errorResponse(res, err);
  }
});

router.post('/users/:login/enable', requireAuth, async (req, res) => {
  try {
    const result = await ldapClient.setUserEnabled(req.params.login, true);
    res.json(result);
  } catch (err) {
    errorResponse(res, err);
  }
});

module.exports = router;