import { NextRequest, NextResponse } from "next/server";
import { requireAdmin, unauthorized } from "@/lib/admin-auth";
import { logAdminActivity } from "@/lib/admin-activity";
import { query } from "@/lib/db";
import { requestMeta } from "@/lib/request-meta";

type ActivityRow = {
  id: number;
  admin_id: number | null;
  username: string | null;
  action: string;
  resource: string | null;
  outcome: string;
  ip: string | null;
  user_agent: string | null;
  meta: unknown;
  created_at: string;
};

export async function GET(req: NextRequest) {
  const admin = await requireAdmin();
  if (!admin) return unauthorized();

  const meta = requestMeta(req);
  const sp = req.nextUrl.searchParams;
  const limit = Math.min(200, Math.max(1, Number(sp.get("limit") || 100)));
  const action = sp.get("action") || "";
  const username = sp.get("username") || "";

  const clauses: string[] = [];
  const params: Record<string, unknown> = { limit };

  if (action) {
    clauses.push("action = :action");
    params.action = action;
  }
  if (username) {
    clauses.push("username = :username");
    params.username = username;
  }

  const where = clauses.length ? `WHERE ${clauses.join(" AND ")}` : "";

  const rows = await query<ActivityRow[]>(
    `SELECT id, admin_id, username, action, resource, outcome, ip, user_agent, meta, created_at
     FROM admin_activity_logs
     ${where}
     ORDER BY created_at DESC
     LIMIT ${limit}`,
    params,
  );

  await logAdminActivity({
    adminId: admin.id,
    username: admin.username,
    action: "view_activity",
    resource: "activity",
    outcome: "success",
    ip: meta.ip,
    userAgent: meta.userAgent,
  });

  return NextResponse.json({ ok: true, logs: rows });
}