import { NextRequest, NextResponse } from "next/server";
import { requireAdmin } from "@/lib/api-auth";
import { db, users, auditLogs, eq } from "@epicure/db";
import { randomUUID } from "crypto";

interface RouteContext {
  params: Promise<{ id: string }>;
}

export async function PATCH(req: NextRequest, { params }: RouteContext) {
  const { session, response } = await requireAdmin();
  if (response) return response;

  const { id } = await params;
  const body = await req.json() as { role?: string; tier?: string; isDeveloper?: boolean; isByokEnabled?: boolean };
  const { role, tier, isDeveloper, isByokEnabled } = body;

  const validRoles = ["user", "moderator", "admin"] as const;
  const validTiers = ["free", "pro", "family"] as const;

  if (role !== undefined && !validRoles.includes(role as typeof validRoles[number])) {
    return NextResponse.json({ error: "Invalid role" }, { status: 400 });
  }
  if (tier !== undefined && !validTiers.includes(tier as typeof validTiers[number])) {
    return NextResponse.json({ error: "Invalid tier" }, { status: 400 });
  }
  if (isDeveloper !== undefined && typeof isDeveloper !== "boolean") {
    return NextResponse.json({ error: "Invalid isDeveloper" }, { status: 400 });
  }
  if (isByokEnabled !== undefined && typeof isByokEnabled !== "boolean") {
    return NextResponse.json({ error: "Invalid isByokEnabled" }, { status: 400 });
  }

  const updateData: Partial<{ role: "user" | "moderator" | "admin"; tier: "free" | "pro" | "family"; isDeveloper: boolean; isByokEnabled: boolean; updatedAt: Date }> = {
    updatedAt: new Date(),
  };
  if (role) updateData.role = role as "user" | "moderator" | "admin";
  if (tier) updateData.tier = tier as "free" | "pro" | "family";
  if (isDeveloper !== undefined) updateData.isDeveloper = isDeveloper;
  if (isByokEnabled !== undefined) updateData.isByokEnabled = isByokEnabled;

  const [updated] = await db
    .update(users)
    .set(updateData)
    .where(eq(users.id, id))
    .returning({ id: users.id, role: users.role, tier: users.tier, isDeveloper: users.isDeveloper, isByokEnabled: users.isByokEnabled });

  if (!updated) {
    return NextResponse.json({ error: "User not found" }, { status: 404 });
  }

  // Write audit log
  await db.insert(auditLogs).values({
    id: randomUUID(),
    userId: session!.user.id,
    action: "admin.user.update",
    targetType: "user",
    targetId: id,
    metadata: JSON.stringify({ role, tier, isDeveloper, isByokEnabled }),
    createdAt: new Date(),
  });

  return NextResponse.json({ user: updated });
}
