export const dynamic = 'force-dynamic';
export const revalidate = 0;

import { NextResponse } from 'next/server';
import { getSql } from '../../../../lib/db.js';
import { getOrgId, getOrgRole } from '../../../../lib/org.js';
import crypto from 'crypto';

function hashKey(key) {
  return crypto.createHash('sha256').update(key).digest('hex');
}

function generateApiKey() {
  const random = crypto.randomBytes(16).toString('hex');
  return `oc_live_${random}`;
}

// GET /api/orgs/[orgId]/keys - List API keys (prefix only, admin only)
export async function GET(request, { params }) {
  try {
    const role = getOrgRole(request);
    if (role !== 'admin') {
      return NextResponse.json({ error: 'Forbidden - admin role required' }, { status: 403 });
    }

    const sql = getSql();
    const { orgId } = await params;

    // SECURITY: Only allow accessing your own org's keys
    const callerOrgId = getOrgId(request);
    if (orgId !== callerOrgId) {
      return NextResponse.json({ error: 'Forbidden - cannot access other organizations' }, { status: 403 });
    }

    // Verify org exists
    const org = await sql`SELECT id FROM organizations WHERE id = ${orgId}`;
    if (org.length === 0) {
      return NextResponse.json({ error: 'Organization not found' }, { status: 404 });
    }

    // Return keys without the hash (security)
    const keys = await sql`
      SELECT id, key_prefix, label, role, last_used_at, created_at, revoked_at
      FROM api_keys
      WHERE org_id = ${orgId}
      ORDER BY created_at DESC
    `;

    return NextResponse.json({ keys });
  } catch (error) {
    console.error('Keys API GET error:', error);
    return NextResponse.json({ error: 'An error occurred while fetching API keys' }, { status: 500 });
  }
}

// POST /api/orgs/[orgId]/keys - Generate new API key (admin only)
export async function POST(request, { params }) {
  try {
    const role = getOrgRole(request);
    if (role !== 'admin') {
      return NextResponse.json({ error: 'Forbidden - admin role required' }, { status: 403 });
    }

    const sql = getSql();
    const { orgId } = await params;

    // SECURITY: Only allow generating keys for your own org
    const callerOrgId = getOrgId(request);
    if (orgId !== callerOrgId) {
      return NextResponse.json({ error: 'Forbidden - cannot access other organizations' }, { status: 403 });
    }

    const body = await request.json();

    // Verify org exists
    const org = await sql`SELECT id FROM organizations WHERE id = ${orgId}`;
    if (org.length === 0) {
      return NextResponse.json({ error: 'Organization not found' }, { status: 404 });
    }

    const { label = 'API Key', role: keyRole = 'member' } = body;

    if (label && label.length > 256) {
      return NextResponse.json({ error: 'label must be 256 characters or fewer' }, { status: 400 });
    }

    const validRoles = ['admin', 'member', 'readonly'];
    if (!validRoles.includes(keyRole)) {
      return NextResponse.json({ error: `role must be one of: ${validRoles.join(', ')}` }, { status: 400 });
    }

    const rawKey = generateApiKey();
    const keyHash = hashKey(rawKey);
    const keyPrefix = rawKey.substring(0, 8);
    const keyId = `key_${crypto.randomUUID()}`;

    await sql`
      INSERT INTO api_keys (id, org_id, key_hash, key_prefix, label, role)
      VALUES (${keyId}, ${orgId}, ${keyHash}, ${keyPrefix}, ${label}, ${keyRole})
    `;

    return NextResponse.json({
      key: {
        id: keyId,
        key: rawKey,
        prefix: keyPrefix,
        label,
        role: keyRole,
        warning: 'Save this key now. It will not be shown again.'
      }
    }, { status: 201 });
  } catch (error) {
    console.error('Keys API POST error:', error);
    return NextResponse.json({ error: 'An error occurred while generating the API key' }, { status: 500 });
  }
}

// DELETE /api/orgs/[orgId]/keys?id=key_xxx - Revoke an API key (admin only)
export async function DELETE(request, { params }) {
  try {
    const role = getOrgRole(request);
    if (role !== 'admin') {
      return NextResponse.json({ error: 'Forbidden - admin role required' }, { status: 403 });
    }

    const sql = getSql();
    const { orgId } = await params;

    // SECURITY: Only allow revoking keys for your own org
    const callerOrgId = getOrgId(request);
    if (orgId !== callerOrgId) {
      return NextResponse.json({ error: 'Forbidden - cannot access other organizations' }, { status: 403 });
    }

    const { searchParams } = new URL(request.url);
    const keyId = searchParams.get('id');

    if (!keyId) {
      return NextResponse.json({ error: 'id query parameter is required' }, { status: 400 });
    }

    const existing = await sql`
      SELECT id, revoked_at FROM api_keys WHERE id = ${keyId} AND org_id = ${orgId}
    `;
    if (existing.length === 0) {
      return NextResponse.json({ error: 'API key not found' }, { status: 404 });
    }
    if (existing[0].revoked_at) {
      return NextResponse.json({ error: 'API key is already revoked' }, { status: 409 });
    }

    await sql`
      UPDATE api_keys SET revoked_at = CURRENT_TIMESTAMP WHERE id = ${keyId} AND org_id = ${orgId}
    `;

    return NextResponse.json({ success: true, revoked: keyId });
  } catch (error) {
    console.error('Keys API DELETE error:', error);
    return NextResponse.json({ error: 'An error occurred while revoking the API key' }, { status: 500 });
  }
}
