import { NextRequest, NextResponse } from "next/server";
import { requireAdmin } from "@/lib/api-auth";
import { db, auditLogs } from "@epicure/db";
import { createInvite, listInvites } from "@/lib/invites";
import { randomUUID } from "crypto";

const VALID_ROLES = ["user", "moderator", "admin"] as const;
const VALID_TIERS = ["free", "pro", "family"] as const;

export async function GET() {
  const { response } = await requireAdmin();
  if (response) return response;

  const invites = await listInvites();
  return NextResponse.json({ invites });
}

export async function POST(req: NextRequest) {
  const { session, response } = await requireAdmin();
  if (response) return response;

  const body = (await req.json()) as {
    email?: string;
    role?: string;
    tier?: string;
    expiresInDays?: number;
  };

  const role = body.role ?? "user";
  const tier = body.tier ?? "free";
  if (!VALID_ROLES.includes(role as (typeof VALID_ROLES)[number])) {
    return NextResponse.json({ error: "Invalid role" }, { status: 400 });
  }
  if (!VALID_TIERS.includes(tier as (typeof VALID_TIERS)[number])) {
    return NextResponse.json({ error: "Invalid tier" }, { status: 400 });
  }

  const invite = await createInvite({
    createdById: session!.user.id,
    email: body.email,
    role: role as (typeof VALID_ROLES)[number],
    tier: tier as (typeof VALID_TIERS)[number],
    expiresInDays: body.expiresInDays ?? 7,
  });

  await db.insert(auditLogs).values({
    id: randomUUID(),
    userId: session!.user.id,
    action: "admin.invite.create",
    targetType: "invite",
    targetId: invite!.id,
    metadata: JSON.stringify({ email: body.email, role, tier }),
    createdAt: new Date(),
  });

  return NextResponse.json({ invite });
}