import { Router } from "express";
import { one, query } from "../../db/client.js";
import { requireAuth } from "../../middleware/auth.js";
import { MODULES } from "../registry.js";

export const dashboardRouter = Router();

dashboardRouter.get("/summary", requireAuth, async (req, res, next) => {
  try {
    const user = req.user!;
    const canViewAudit = user.permissions.has("admin.audit.view");
    const canManageUsers = user.permissions.has("admin.manage_users");

    // Real operational counts only — no invented business data (members module is not built yet)
    const [userStats, roleStats, sessionStats, auditStats, lastMigration] = await Promise.all([
      one<{ total: string; active: string; demo: string }>(
        `SELECT COUNT(*)::text AS total, COUNT(*) FILTER (WHERE is_active)::text AS active, COUNT(*) FILTER (WHERE is_demo)::text AS demo FROM users`,
      ),
      one<{ total: string; confirmed: string; assignments: string }>(
        `SELECT
           (SELECT COUNT(*) FROM roles)::text AS total,
           (SELECT COUNT(*) FROM roles WHERE governance_confirmed)::text AS confirmed,
           (SELECT COUNT(*) FROM user_roles WHERE revoked_at IS NULL)::text AS assignments`,
      ),
      one<{ active: string }>(
        `SELECT COUNT(*)::text AS active FROM sessions WHERE revoked_at IS NULL AND expires_at > now()`,
      ),
      one<{ last24h: string }>(`SELECT COUNT(*)::text AS last24h FROM audit_logs WHERE occurred_at > now() - interval '24 hours'`),
      one<{ version: string; applied_at: string }>(
        `SELECT version, applied_at::text FROM schema_migrations ORDER BY version DESC LIMIT 1`,
      ),
    ]);

    let recentAudit: unknown[] = [];
    if (canViewAudit) {
      const rows = await query(
        `SELECT a.id, a.occurred_at::text, a.action, a.entity_type, a.entity_id, u.username AS actor_username
           FROM audit_logs a LEFT JOIN users u ON u.id = a.actor_user_id
          ORDER BY a.id DESC LIMIT 8`,
      );
      recentAudit = rows.rows;
    }

    const modules = MODULES.map((m) => ({
      code: m.code,
      nameAr: m.nameAr,
      nameEn: m.nameEn,
      description: m.description,
      descriptionEn: m.descriptionEn,
      href: m.href,
      color: m.color,
      status: m.status,
      // Accessible now only when the module is implemented AND the user holds its permission
      accessible: m.status === "ready" && user.permissions.has(m.permission),
      // Whether the user would hold access once the module ships (per current draft permissions)
      permitted: user.permissions.has(m.permission),
    }));

    res.json({
      user: { id: user.id, fullName: user.fullName, isDemo: user.isDemo, mustChangePassword: user.mustChangePassword },
      stats: {
        users: { total: Number(userStats?.total ?? 0), active: Number(userStats?.active ?? 0), demo: Number(userStats?.demo ?? 0) },
        roles: { total: Number(roleStats?.total ?? 0), governanceConfirmed: Number(roleStats?.confirmed ?? 0), activeAssignments: Number(roleStats?.assignments ?? 0) },
        activeSessions: Number(sessionStats?.active ?? 0),
        auditEvents24h: Number(auditStats?.last24h ?? 0),
      },
      recentAudit,
      system: {
        schemaVersion: lastMigration?.version ?? null,
        schemaAppliedAt: lastMigration?.applied_at ?? null,
        canViewAudit,
        canManageUsers,
      },
      modules,
    });
  } catch (error) {
    next(error);
  }
});