import { NextRequest, NextResponse } from "next/server";
import {
  forbidden,
  requireAdmin,
  requireRole,
  unauthorized,
} from "@/lib/admin-auth";
import { logAdminActivity } from "@/lib/admin-activity";
import { query } from "@/lib/db";
import { requestMeta } from "@/lib/request-meta";

type SecurityRow = {
  id: number;
  category: string;
  severity: string;
  title: string;
  detail: unknown;
  source_ip: string | null;
  status: string;
  created_at: string;
  resolved_at: string | null;
};

export async function GET(req: NextRequest) {
  const admin = await requireAdmin();
  if (!admin) return unauthorized();

  const meta = requestMeta(req);
  const sp = req.nextUrl.searchParams;
  const limit = Math.min(200, Math.max(1, Number(sp.get("limit") || 100)));
  const status = sp.get("status") || "";
  const severity = sp.get("severity") || "";

  const clauses: string[] = [];
  const params: Record<string, unknown> = {};

  if (status) {
    clauses.push("status = :status");
    params.status = status;
  }
  if (severity) {
    clauses.push("severity = :severity");
    params.severity = severity;
  }

  const where = clauses.length ? `WHERE ${clauses.join(" AND ")}` : "";

  const rows = await query<SecurityRow[]>(
    `SELECT id, category, severity, title, detail, source_ip, status, created_at, resolved_at
     FROM security_events
     ${where}
     ORDER BY
       FIELD(severity, 'critical', 'high', 'medium', 'low'),
       created_at DESC
     LIMIT ${limit}`,
    params,
  );

  await logAdminActivity({
    adminId: admin.id,
    username: admin.username,
    action: "view_security",
    resource: "security",
    outcome: "success",
    ip: meta.ip,
    userAgent: meta.userAgent,
  });

  return NextResponse.json({ ok: true, events: rows });
}

export async function POST(req: NextRequest) {
  const loggedIn = await requireAdmin();
  if (!loggedIn) return unauthorized();
  const admin = await requireRole(["superadmin", "auditor", "operator"]);
  if (!admin) return forbidden();

  const meta = requestMeta(req);
  try {
    const body = (await req.json()) as {
      id?: number;
      status?: "acknowledged" | "resolved" | "open";
    };

    if (!body.id || !body.status) {
      return NextResponse.json(
        { ok: false, error: "id and status required" },
        { status: 400 },
      );
    }
    if (!["acknowledged", "resolved", "open"].includes(body.status)) {
      return NextResponse.json(
        { ok: false, error: "Invalid status" },
        { status: 400 },
      );
    }

    await query(
      `UPDATE security_events
       SET status = :status,
           resolved_at = CASE WHEN :status = 'resolved' THEN NOW() ELSE resolved_at END
       WHERE id = :id`,
      { id: body.id, status: body.status },
    );

    await logAdminActivity({
      adminId: admin.id,
      username: admin.username,
      action: "update_security_event",
      resource: `security/${body.id}`,
      outcome: "success",
      ip: meta.ip,
      userAgent: meta.userAgent,
      meta: { status: body.status },
    });

    return NextResponse.json({ ok: true });
  } catch (e) {
    console.error("security update failed", e);
    return NextResponse.json(
      { ok: false, error: "Update failed" },
      { status: 500 },
    );
  }
}