"use server";

import { eq } from "drizzle-orm";
import { headers } from "next/headers";
import { revalidatePath } from "next/cache";
import { z } from "zod";

import { getDb } from "@/db";
import { users } from "@/db/schema";
import { getAuth, requireAdmin } from "@/lib/auth/server";
import {
  auditActor,
  writeAuditLogBestEffort,
} from "@/lib/audit-log";

export interface CreateAccountState {
  status: "idle" | "error" | "success";
  message: string;
}

const accountSchema = z
  .object({
    name: z.string().trim().min(1).max(100),
    email: z.email().transform((value) => value.toLowerCase()),
    password: z.string().min(12).max(128),
    passwordConfirmation: z.string(),
  })
  .refine((data) => data.password === data.passwordConfirmation, {
    path: ["passwordConfirmation"],
  });

export async function createAccount(
  _previousState: CreateAccountState,
  formData: FormData,
): Promise<CreateAccountState> {
  const admin = await requireAdmin();
  const parsed = accountSchema.safeParse(Object.fromEntries(formData));
  if (!parsed.success) {
    return { status: "error", message: "โปรดตรวจสอบชื่อ อีเมล และรหัสผ่านให้ถูกต้อง" };
  }

  const existing = await getDb().query.users.findFirst({
    columns: { id: true },
    where: eq(users.email, parsed.data.email),
  });
  if (existing) {
    return { status: "error", message: "อีเมลนี้มีบัญชีอยู่แล้ว" };
  }

  try {
    const created = await getAuth().api.createUser({
      body: {
        name: parsed.data.name,
        email: parsed.data.email,
        password: parsed.data.password,
        role: "admin",
        data: { emailVerified: true },
      },
      headers: await headers(),
    });
    await writeAuditLogBestEffort(auditActor(admin.user), {
      action: "admin_account.created",
      targetType: "admin_account",
      targetId: created.user.id,
      metadata: {
        accountLabel: created.user.name?.trim() || created.user.email,
      },
    });
  } catch {
    return { status: "error", message: "สร้างบัญชีไม่สำเร็จ โปรดลองอีกครั้ง" };
  }

  revalidatePath("/admin/register");
  return { status: "success", message: `สร้างบัญชี ${parsed.data.email} แล้ว` };
}

export async function removeAccount(
  userId: string,
): Promise<{ status: "error" | "success"; message?: string }> {
  const session = await requireAdmin();
  if (!z.string().min(1).max(128).safeParse(userId).success) {
    return { status: "error", message: "บัญชีไม่ถูกต้อง" };
  }
  if (userId === session.user.id) {
    return { status: "error", message: "ไม่สามารถลบบัญชีที่กำลังใช้งานอยู่" };
  }

  const [target] = await getDb()
    .select({ name: users.name, email: users.email })
    .from(users)
    .where(eq(users.id, userId))
    .limit(1);
  if (!target) return { status: "error", message: "ไม่พบบัญชีนี้" };

  try {
    await getAuth().api.removeUser({
      body: { userId },
      headers: await headers(),
    });
    await writeAuditLogBestEffort(auditActor(session.user), {
      action: "admin_account.removed",
      targetType: "admin_account",
      targetId: userId,
      metadata: {
        accountLabel: target.name.trim() || target.email,
      },
    });
  } catch {
    return { status: "error", message: "ลบบัญชีไม่สำเร็จ โปรดลองอีกครั้ง" };
  }

  revalidatePath("/admin/register");
  return { status: "success" };
}