/**
 * REST API routes for repository management.
 */

import { Hono } from "hono";
import type { AuthEnv } from "../middleware/auth";
import { eq, and, isNull, ilike, sql } from "drizzle-orm";
import { db } from "../db";
import { users, repositories, organizations, orgMembers } from "../db/schema";
import { initBareRepo, repoExists } from "../git/repository";
import { hashPassword } from "../lib/auth";
import { orgRoleAtLeast } from "../lib/orgs";
import { renderMarkdown } from "../lib/markdown";

// Typed with AuthEnv so handlers can read the viewer that the global
// `softAuth` middleware already resolved (needed for private-repo gating).
const api = new Hono<AuthEnv>().basePath("/api");

// Create repository
api.post("/repos", async (c) => {
  // This handler had NO auth middleware and took the target namespace from
  // `owner` in the request body, so anyone on the internet could create
  // repositories inside any user's namespace. csrfProtect does not help:
  // src/middleware/csrf.ts explicitly exempts paths under /api/.
  //
  // softAuth (applied globally in app.tsx) has already resolved a session
  // cookie, an OAuth bearer, or a `glc_` PAT into c.get("user"), so an inline
  // check is enough — and returns a JSON 401 rather than the HTML redirect
  // requireAuth would issue for a cookie-less caller.
  const viewer = c.get("user");
  if (!viewer) {
    return c.json(
      { error: "Authentication required", hint: "Use Authorization: Bearer <token> header" },
      401
    );
  }

  let body: {
    name: string;
    owner: string;
    orgSlug?: string;
    description?: string;
    isPrivate?: boolean;
  };
  try {
    body = await c.req.json();
  } catch {
    return c.json({ error: "Invalid JSON body" }, 400);
  }

  if (!body.name) {
    return c.json({ error: "name is required" }, 400);
  }

  // The caller may only create in their own namespace. `owner` is now
  // optional; if supplied it must match, so an old client that sends its own
  // username keeps working while a forged one is refused. Org placement still
  // goes through orgSlug below, which checks the creator's admin rights.
  if (body.owner && body.owner !== viewer.username) {
    return c.json(
      { error: "Cannot create a repository in another user's namespace" },
      403
    );
  }
  body.owner = viewer.username;

  // Validate repo name
  if (!/^[a-zA-Z0-9._-]+$/.test(body.name)) {
    return c.json({ error: "Invalid repository name" }, 400);
  }
  // Normalize to lowercase — repo slugs are canonically lowercase so
  // "MyRepo" and "myrepo" can't both exist and cause "Vapron" vs "vapron"
  // confusion. Applied before the duplicate checks + on-disk init below.
  body.name = body.name.toLowerCase();

  try {
    // Find creator (user who is performing the action)
    const [owner] = await db
      .select()
      .from(users)
      .where(eq(users.username, body.owner));

    if (!owner) {
      return c.json({ error: "Owner not found" }, 404);
    }

    // B2: if orgSlug supplied, place the repo in the org namespace.
    // Requires the creator to be an admin+ of the org.
    let orgId: string | null = null;
    let namespaceSlug = body.owner;
    if (body.orgSlug) {
      const [org] = await db
        .select({ id: organizations.id, slug: organizations.slug })
        .from(organizations)
        .where(eq(organizations.slug, body.orgSlug))
        .limit(1);
      if (!org) return c.json({ error: "Organization not found" }, 404);

      const [mem] = await db
        .select({ role: orgMembers.role })
        .from(orgMembers)
        .where(
          and(eq(orgMembers.orgId, org.id), eq(orgMembers.userId, owner.id))
        )
        .limit(1);
      if (!mem || !orgRoleAtLeast(mem.role, "admin")) {
        return c.json({ error: "Admin rights required on org" }, 403);
      }
      orgId = org.id;
      namespaceSlug = org.slug;
    }

    // Duplicate check: scoped to the right namespace.
    if (orgId) {
      const [existing] = await db
        .select({ id: repositories.id })
        .from(repositories)
        .where(
          and(eq(repositories.orgId, orgId), eq(repositories.name, body.name))
        )
        .limit(1);
      if (existing) {
        return c.json({ error: "Repository already exists" }, 409);
      }
    } else {
      const [existing] = await db
        .select({ id: repositories.id })
        .from(repositories)
        .where(
          and(
            eq(repositories.ownerId, owner.id),
            eq(repositories.name, body.name),
            isNull(repositories.orgId)
          )
        )
        .limit(1);
      if (existing) {
        return c.json({ error: "Repository already exists" }, 409);
      }
    }
    if (await repoExists(namespaceSlug, body.name)) {
      return c.json({ error: "Repository already exists" }, 409);
    }

    // Init bare repo on disk, keyed by the namespace slug (user or org).
    const diskPath = await initBareRepo(namespaceSlug, body.name);

    // Insert into DB
    const [repo] = await db
      .insert(repositories)
      .values({
        name: body.name,
        ownerId: owner.id,
        orgId,
        description: body.description || null,
        isPrivate: body.isPrivate || false,
        diskPath,
      })
      .returning();

    // Green-ecosystem bootstrap: settings, protection, labels, welcome issue
    if (repo) {
      const { bootstrapRepository, ensureAiBuildSeedIssue } = await import("../lib/repo-bootstrap");
      await bootstrapRepository({
        repositoryId: repo.id,
        ownerUserId: owner.id,
      });
      // Fire-and-forget — never block the response
      ensureAiBuildSeedIssue(repo.id, owner.id).catch(err =>
        console.warn('[ai-build-seed]', err?.message)
      );
    }

    return c.json(repo, 201);
  } catch (err) {
    console.error("[api] POST /repos:", err);
    return c.json({ error: "Service unavailable" }, 503);
  }
});

// List user's repositories
api.get("/users/:username/repos", async (c) => {
  const { username } = c.req.param();
  try {
    const [owner] = await db
      .select()
      .from(users)
      .where(eq(users.username, username));
    if (!owner) return c.json({ error: "User not found" }, 404);

    // Sibling fix to GET /repos/:owner/:name: that handler was gated but this
    // list was not, so it kept returning every private repo the user owns —
    // name, description, ownerId and the internal diskPath — to anonymous
    // callers. Filter per row through the same access helper the HTML surface
    // uses, so collaborators and org members keep seeing what they should.
    const rows = await db
      .select()
      .from(repositories)
      .where(eq(repositories.ownerId, owner.id));

    const viewer = c.get("user");
    const { resolveRepoAccess } = await import("../middleware/repo-access");
    const visible = (
      await Promise.all(
        rows.map(async (r) => {
          if (!r.isPrivate) return r;
          const access = await resolveRepoAccess({
            repoId: r.id,
            userId: viewer?.id ?? null,
            isPublic: false,
          });
          return access === "none" ? null : r;
        })
      )
    ).filter((r): r is (typeof rows)[number] => r !== null);

    // diskPath leaks the server's storage layout — never serialize it.
    const safe = visible.map(({ diskPath: _diskPath, ...rest }) => rest);

    return c.json(safe);
  } catch (err) {
    console.error("[api] /users/:username/repos:", err);
    return c.json({ error: "Service unavailable" }, 503);
  }
});

// Get single repository (resolves both user- and org-owned namespaces)
api.get("/repos/:owner/:name", async (c) => {
  const { owner: ownerName, name } = c.req.param();
  try {
    const { loadRepoByPath } = await import("../lib/namespace");
    const repo = await loadRepoByPath(ownerName, name);
    if (!repo) return c.json({ error: "Not found" }, 404);

    // A private repo must not disclose its existence — let alone its
    // description, ownerId and on-disk path — to a viewer without read
    // access. Mirror the HTML surface, which already 404s here.
    const viewer = c.get("user");
    const { resolveRepoAccess } = await import("../middleware/repo-access");
    const access = await resolveRepoAccess({
      repoId: repo.id,
      userId: viewer?.id ?? null,
      isPublic: !repo.isPrivate,
    });
    if (access === "none") return c.json({ error: "Not found" }, 404);

    // `diskPath` is server-internal (it leaks the storage layout); never
    // serialize it to an API client regardless of access level.
    const { diskPath: _diskPath, ...safeRepo } = repo as typeof repo & {
      diskPath?: string;
    };
    return c.json(safeRepo);
  } catch (err) {
    console.error("[api] /repos/:owner/:name:", err);
    return c.json({ error: "Service unavailable" }, 503);
  }
});

// Quick-setup: create user + repo in one call (dev convenience)
api.post("/setup", async (c) => {
  // First-run bootstrap ONLY.
  //
  // This endpoint was completely unauthenticated and upserts a user, seeding
  // any username that does not yet exist with the fixed password "changeme".
  // On a populated instance that is anonymous account creation plus username
  // squatting — register the victim's preferred handle, or any name that looks
  // official, with a password the attacker already knows.
  //
  // Its legitimate purpose is seeding the very first account on a fresh
  // install, so gate it on the instance genuinely being empty. There are no
  // production callers; the only references are tests.
  let userCount: number;
  try {
    const [row] = await db.select({ n: sql<number>`count(*)::int` }).from(users);
    userCount = Number(row?.n ?? 0);
  } catch {
    // Fail CLOSED. If we cannot prove the instance is empty we must not seed
    // an account — an unreachable DB is not permission to bootstrap.
    return c.json({ error: "Service unavailable" }, 503);
  }
  if (userCount > 0) {
    // 404, not 403: on a live instance this endpoint simply does not exist.
    return c.json({ error: "Not found" }, 404);
  }

  let body: {
    username: string;
    email: string;
    repoName: string;
    description?: string;
  };
  try {
    body = await c.req.json();
  } catch {
    return c.json({ error: "Invalid JSON body" }, 400);
  }
  if (!body.username || !body.email || !body.repoName) {
    return c.json(
      { error: "username, email, and repoName are required" },
      400
    );
  }

  try {
    // Upsert user
    let [user] = await db
      .select()
      .from(users)
      .where(eq(users.username, body.username));

    if (!user) {
      [user] = await db
        .insert(users)
        .values({
          username: body.username,
          email: body.email,
          passwordHash: await hashPassword("changeme"),
        })
        .returning();
    }

    // Create repo if not exists
    if (!(await repoExists(body.username, body.repoName))) {
      const diskPath = await initBareRepo(body.username, body.repoName);
      const [repo] = await db
        .insert(repositories)
        .values({
          name: body.repoName,
          ownerId: user.id,
          description: body.description || null,
          diskPath,
        })
        .returning();
      if (repo) {
        const { bootstrapRepository } = await import("../lib/repo-bootstrap");
        await bootstrapRepository({
          repositoryId: repo.id,
          ownerUserId: user.id,
        });
      }
    }

    return c.json({
      user: user.username,
      repo: body.repoName,
      status: "ready",
    });
  } catch (err) {
    console.error("[api] POST /setup:", err);
    return c.json({ error: "Service unavailable" }, 503);
  }
});

// Markdown preview — render markdown to HTML for the live preview tab.
// Body: { text: string }. Returns { html: string }.
// Rate-limited by the global limiter in middleware. No auth required.
api.post("/markdown/preview", async (c) => {
  let text = "";
  try {
    const body = await c.req.json();
    text = String(body.text || "").slice(0, 64_000);
  } catch {
    return c.json({ html: "" }, 400);
  }
  const html = renderMarkdown(text);
  return c.json({ html });
});

// User mention autocomplete — returns up to 8 matching usernames for `@` suggestions.
// Public endpoint (no auth required) since usernames are public.
api.get("/users/suggest", async (c) => {
  const q = String(c.req.query("q") || "").trim().replace(/^@/, "").slice(0, 39);
  if (!q) return c.json({ users: [] });
  try {
    const rows = await db
      .select({ username: users.username, displayName: users.displayName })
      .from(users)
      .where(ilike(users.username, `${q}%`))
      .orderBy(sql`lower(${users.username})`)
      .limit(8);
    return c.json({ users: rows });
  } catch {
    return c.json({ users: [] });
  }
});

export default api;