import express from 'express';
import bcrypt from 'bcryptjs';
import { db } from './db';

export const authRouter = express.Router();

authRouter.post('/login', (req, res) => {
  const { username, password } = req.body;
  if (!username || !password) {
    return res.render('message', { title: 'Error', message: 'Please provide both username and password.', backUrl: '/login' });
  }

  const user = db.prepare('SELECT * FROM users WHERE user_name = ?').get(username) as any;
  if (!user || !bcrypt.compareSync(password, user.user_password)) {
    return res.render('message', { title: 'Login Failed', message: 'Invalid username or password.', backUrl: '/login' });
  }

  const group = db.prepare('SELECT * FROM usergroups WHERE group_id = ?').get(user.user_group) as any;

  (req.session as any).user = {
    id: user.user_id,
    name: user.user_name,
    email: user.user_email,
    groupId: user.user_group,
    isAdmin: group ? Boolean(group.has_admin_access) : false
  };

  res.redirect('/');
});

authRouter.post('/register', (req, res) => {
  const { username, email, password, password_again } = req.body;
  if (!username || !email || !password) {
    return res.render('message', { title: 'Error', message: 'Please fill in all required fields.', backUrl: '/register' });
  }
  if (password !== password_again) {
    return res.render('message', { title: 'Error', message: 'Passwords do not match.', backUrl: '/register' });
  }

  const existing = db.prepare('SELECT user_id FROM users WHERE user_name = ?').get(username);
  if (existing) {
    return res.render('message', { title: 'Error', message: 'Username is already taken.', backUrl: '/register' });
  }

  const hash = bcrypt.hashSync(password, 10);
  const result = db.prepare('INSERT INTO users (user_group, user_name, user_password, user_email) VALUES (?, ?, ?, ?)').run(2, username, hash, email);

  (req.session as any).user = {
    id: Number(result.lastInsertRowid),
    name: username,
    email: email,
    groupId: 2,
    isAdmin: false
  };

  res.redirect('/');
});

authRouter.get('/logout', (req, res) => {
  req.session.destroy(() => {
    res.redirect('/');
  });
});