import { AuditAction, AuditResourceType, recordAudit } from '@sim/audit'
import { db } from '@sim/db'
import { apiKey } from '@sim/db/schema'
import { createLogger } from '@sim/logger'
import { getErrorMessage } from '@sim/utils/errors'
import { and, eq, not } from 'drizzle-orm'
import { type NextRequest, NextResponse } from 'next/server'
import { updateWorkspaceApiKeyContract } from '@/lib/api/contracts/api-keys'
import { parseRequest } from '@/lib/api/server'
import { getSession } from '@/lib/auth'
import { generateRequestId } from '@/lib/core/utils/request'
import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
import { captureServerEvent } from '@/lib/posthog/server'
import { getUserEntityPermissions } from '@/lib/workspaces/permissions/utils'

const logger = createLogger('WorkspaceApiKeyAPI')

export const PUT = withRouteHandler(
  async (request: NextRequest, context: { params: Promise<{ id: string; keyId: string }> }) => {
    const requestId = generateRequestId()
    const { id: workspaceId, keyId } = await context.params

    try {
      const session = await getSession()
      if (!session?.user?.id) {
        logger.warn(`[${requestId}] Unauthorized workspace API key update attempt`)
        return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
      }

      const userId = session.user.id

      const permission = await getUserEntityPermissions(userId, 'workspace', workspaceId)
      if (permission !== 'admin') {
        return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
      }

      const parsed = await parseRequest(updateWorkspaceApiKeyContract, request, context)
      if (!parsed.success) return parsed.response
      const { name } = parsed.data.body

      const existingKey = await db
        .select()
        .from(apiKey)
        .where(
          and(
            eq(apiKey.workspaceId, workspaceId),
            eq(apiKey.id, keyId),
            eq(apiKey.type, 'workspace')
          )
        )
        .limit(1)

      if (existingKey.length === 0) {
        return NextResponse.json({ error: 'API key not found' }, { status: 404 })
      }

      const conflictingKey = await db
        .select()
        .from(apiKey)
        .where(
          and(
            eq(apiKey.workspaceId, workspaceId),
            eq(apiKey.name, name),
            eq(apiKey.type, 'workspace'),
            not(eq(apiKey.id, keyId))
          )
        )
        .limit(1)

      if (conflictingKey.length > 0) {
        return NextResponse.json(
          { error: 'A workspace API key with this name already exists' },
          { status: 400 }
        )
      }

      const [updatedKey] = await db
        .update(apiKey)
        .set({
          name,
          updatedAt: new Date(),
        })
        .where(
          and(
            eq(apiKey.workspaceId, workspaceId),
            eq(apiKey.id, keyId),
            eq(apiKey.type, 'workspace')
          )
        )
        .returning({
          id: apiKey.id,
          name: apiKey.name,
          createdAt: apiKey.createdAt,
          updatedAt: apiKey.updatedAt,
        })

      recordAudit({
        workspaceId,
        actorId: userId,
        action: AuditAction.API_KEY_UPDATED,
        resourceType: AuditResourceType.API_KEY,
        resourceId: keyId,
        actorName: session.user.name ?? undefined,
        actorEmail: session.user.email ?? undefined,
        resourceName: name,
        description: `Renamed workspace API key from "${existingKey[0].name}" to "${name}"`,
        metadata: {
          keyType: 'workspace',
          previousName: existingKey[0].name,
          newName: name,
        },
        request,
      })

      logger.info(`[${requestId}] Updated workspace API key: ${keyId} in workspace ${workspaceId}`)
      return NextResponse.json({ key: updatedKey })
    } catch (error: unknown) {
      logger.error(`[${requestId}] Workspace API key PUT error`, error)
      return NextResponse.json(
        { error: getErrorMessage(error, 'Failed to update workspace API key') },
        { status: 500 }
      )
    }
  }
)

export const DELETE = withRouteHandler(
  async (request: NextRequest, { params }: { params: Promise<{ id: string; keyId: string }> }) => {
    const requestId = generateRequestId()
    const { id: workspaceId, keyId } = await params

    try {
      const session = await getSession()
      if (!session?.user?.id) {
        logger.warn(`[${requestId}] Unauthorized workspace API key deletion attempt`)
        return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
      }

      const userId = session.user.id

      const permission = await getUserEntityPermissions(userId, 'workspace', workspaceId)
      if (permission !== 'admin') {
        return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
      }

      const deletedRows = await db
        .delete(apiKey)
        .where(
          and(
            eq(apiKey.workspaceId, workspaceId),
            eq(apiKey.id, keyId),
            eq(apiKey.type, 'workspace')
          )
        )
        .returning({ id: apiKey.id, name: apiKey.name, lastUsed: apiKey.lastUsed })

      if (deletedRows.length === 0) {
        return NextResponse.json({ error: 'API key not found' }, { status: 404 })
      }

      const deletedKey = deletedRows[0]

      captureServerEvent(
        userId,
        'api_key_revoked',
        { workspace_id: workspaceId, key_name: deletedKey.name },
        { groups: { workspace: workspaceId } }
      )

      recordAudit({
        workspaceId,
        actorId: userId,
        action: AuditAction.API_KEY_REVOKED,
        resourceType: AuditResourceType.API_KEY,
        resourceId: keyId,
        actorName: session.user.name ?? undefined,
        actorEmail: session.user.email ?? undefined,
        resourceName: deletedKey.name,
        description: `Revoked workspace API key: ${deletedKey.name}`,
        metadata: {
          keyType: 'workspace',
          keyName: deletedKey.name,
          lastUsed: deletedKey.lastUsed?.toISOString() ?? null,
        },
        request,
      })

      logger.info(
        `[${requestId}] Deleted workspace API key: ${keyId} from workspace ${workspaceId}`
      )
      return NextResponse.json({ success: true })
    } catch (error: unknown) {
      logger.error(`[${requestId}] Workspace API key DELETE error`, error)
      return NextResponse.json(
        { error: getErrorMessage(error, 'Failed to delete workspace API key') },
        { status: 500 }
      )
    }
  }
)
