const express = require('express');
const crypto = require('crypto');
const { requireRole } = require('../middleware/auth');
const { hashSecret, maskSecret } = require('../utils/security');

const createApiKeysRouter = ({ pool }) => {
  const router = express.Router();

  router.get('/api-keys', requireRole(['admin', 'super_admin']), async (req, res) => {
    try {
      const { tenantId } = req.query;
      const effectiveTenantId = req.user.role === 'super_admin' ? tenantId : req.user.tenant_id;
      if (!effectiveTenantId || effectiveTenantId === 'all') return res.json([]);

      const [rows] = await pool.query(
        'SELECT id, name, created_at, last_used_at, CASE WHEN secret_key LIKE "masked:%" THEN CONCAT("fasto_sk_", RIGHT(secret_key, 6), "...") ELSE CONCAT(SUBSTRING(secret_key, 1, 14), "...") END as masked_key FROM api_keys WHERE tenant_id = ?',
        [effectiveTenantId]
      );
      res.json(rows);
    } catch (error) {
      res.status(500).json({ error: error.message });
    }
  });

  router.post('/api-keys', requireRole(['admin', 'super_admin']), async (req, res) => {
    const { name, tenantId } = req.body;
    const effectiveTenantId = req.user.role === 'super_admin' ? tenantId : req.user.tenant_id;
    try {
      const id = `apk_${crypto.randomUUID().split('-')[0]}`;
      const secretKey = `fasto_sk_${crypto.randomBytes(32).toString('hex')}`;

      await pool.query(
        'INSERT INTO api_keys (id, tenant_id, name, secret_key, secret_hash) VALUES (?, ?, ?, ?, ?)',
        [id, effectiveTenantId, name || 'Nova Integração API', maskSecret(id, secretKey), hashSecret(secretKey)]
      );

      res.status(201).json({ id, secret_key: secretKey, message: 'Chave criada. Salve-a agora, ela não será exibida novamente.' });
    } catch (error) {
      res.status(500).json({ error: error.message });
    }
  });

  router.delete('/api-keys/:id', requireRole(['admin', 'super_admin']), async (req, res) => {
    try {
      const [existing] = await pool.query('SELECT tenant_id FROM api_keys WHERE id = ?', [req.params.id]);
      if (existing.length === 0) return res.status(404).json({ error: 'Chave não encontrada' });
      if (req.user.role !== 'super_admin' && existing[0].tenant_id !== req.user.tenant_id) return res.status(403).json({ error: 'Acesso negado' });

      await pool.query('DELETE FROM api_keys WHERE id = ?', [req.params.id]);
      res.json({ message: 'Chave de API revogada com sucesso.' });
    } catch (error) {
      res.status(500).json({ error: error.message });
    }
  });

  return router;
};

module.exports = {
  createApiKeysRouter,
};