import jwt from 'jsonwebtoken'
import { config } from '../config/index.js'
import { safeRedis } from '../config/redis.js'
import { AppError } from '../lib/AppError.js'
import { prisma } from '../config/database.js'
import { SAFE_USER_SELECT, ROLE_HIERARCHY, CACHE_PREFIX } from '../lib/constants.js'

export async function authenticate(req, res, next) {
  try {
    const authHeader = req.headers.authorization
    if (!authHeader?.startsWith('Bearer ')) {
      throw new AppError('لم يتم توفير رمز المصادقة', 401, 'NO_TOKEN')
    }
    const token = authHeader.split(' ')[1]

    const isBlacklisted = await safeRedis.get(CACHE_PREFIX.BLACKLIST(token))
    if (isBlacklisted) throw new AppError('رمز المصادقة ملغي', 401, 'TOKEN_REVOKED')

    let decoded
    try {
      decoded = jwt.verify(token, config.JWT_ACCESS_SECRET)
    } catch (err) {
      if (err.name === 'TokenExpiredError') throw new AppError('انتهت صلاحية الجلسة', 401, 'TOKEN_EXPIRED')
      throw new AppError('رمز المصادقة غير صحيح', 401, 'INVALID_TOKEN')
    }

    const isSuspended = await safeRedis.get(CACHE_PREFIX.SUSPENDED(decoded.sub))
    if (isSuspended) throw new AppError('بيانات تسجيل الدخول غير صحيحة', 401, 'INVALID_CREDENTIALS')

    const user = await prisma.user.findUnique({
      where: { id: decoded.sub },
      select: { ...SAFE_USER_SELECT, bannedUntil: true },
    })

    if (!user || !user.isActive) {
      throw new AppError('بيانات تسجيل الدخول غير صحيحة', 401, 'INVALID_CREDENTIALS')
    }

    if (user.bannedUntil && new Date(user.bannedUntil) > new Date()) {
      throw new AppError('تم حظر حسابك مؤقتاً', 403, 'ACCOUNT_BANNED')
    }

    req.user = user
    next()
  } catch (err) {
    next(err)
  }
}

export function requireRole(...roles) {
  return (req, res, next) => {
    if (!req.user) return next(new AppError('غير مصادق', 401, 'UNAUTHORIZED'))
    if (!roles.includes(req.user.role)) {
      return next(new AppError('ليس لديك صلاحية', 403, 'FORBIDDEN'))
    }
    next()
  }
}

export const requireAdmin = requireRole('ADMIN', 'SUPER_ADMIN')
export const requireSupport = requireRole('ADMIN', 'SUPPORT', 'ACCOUNTS', 'SUPER_ADMIN')

export function canModifyUser(actorRole, targetRole) {
  const allowed = ROLE_HIERARCHY[actorRole] || []
  return allowed.includes(targetRole)
}