/**
 * Tenant Self-Management Routes
 * Allows tenant admins to manage their own tenant settings
 */

const express = require('express');
const router = express.Router();
const { Tenant, User } = require('../models');
const { authenticateToken } = require('../middleware/auth');
const { requirePermissions, requireAnyPermission, hasPermission } = require('../middleware/rbac');
const MultiTenantAuth = require('../middleware/multi-tenant-auth');

// Initialize multi-tenant auth
const multiAuth = new MultiTenantAuth();

/**
 * GET /tenant/info
 * Get current tenant information
 */
router.get('/info', authenticateToken, requirePermissions(['tenant.view']), async (req, res) => {
  try {
    // Determine tenant from request
    const tenantId = await multiAuth.determineTenant(req);
    if (!tenantId) {
      return res.status(400).json({
        success: false,
        message: 'Unable to determine tenant'
      });
    }

    const tenant = await Tenant.findOne({ where: { slug: tenantId } });
    if (!tenant) {
      return res.status(404).json({
        success: false,
        message: 'Tenant not found'
      });
    }

    // Return tenant info (excluding sensitive data)
    const tenantInfo = {
      id: tenant.id,
      name: tenant.name,
      slug: tenant.slug,
      domain: tenant.domain,
      subscription_type: tenant.subscription_type,
      is_active: tenant.is_active,
      auth_provider: tenant.auth_provider,
      branding: tenant.branding,
      features: tenant.features,
      admin_email: tenant.admin_email,
      admin_phone: tenant.admin_phone,
      billing_email: tenant.billing_email,
      created_at: tenant.created_at,
      // IP restriction info (for security admins only)
      ip_restriction_enabled: hasPermission(req.user.role, 'security.view') ? tenant.ip_restriction_enabled : undefined,
      ip_whitelist: hasPermission(req.user.role, 'security.view') ? tenant.ip_whitelist : undefined,
      ip_restriction_message: hasPermission(req.user.role, 'security.view') ? tenant.ip_restriction_message : undefined
    };

    res.json({
      success: true,
      data: tenantInfo
    });

  } catch (error) {
    console.error('Error fetching tenant info:', error);
    res.status(500).json({
      success: false,
      message: 'Failed to fetch tenant information'
    });
  }
});

/**
 * PUT /tenant/branding
 * Update tenant branding (branding admin or higher)
 */
router.put('/branding', authenticateToken, requirePermissions(['branding.edit']), async (req, res) => {
  try {
    // Determine tenant from request
    const tenantId = await multiAuth.determineTenant(req);
    if (!tenantId) {
      return res.status(400).json({
        success: false,
        message: 'Unable to determine tenant'
      });
    }

    const tenant = await Tenant.findOne({ where: { slug: tenantId } });
    if (!tenant) {
      return res.status(404).json({
        success: false,
        message: 'Tenant not found'
      });
    }

    const { logo_url, primary_color, secondary_color, company_name } = req.body;

    // Validate colors
    const colorRegex = /^#([A-Fa-f0-9]{6}|[A-Fa-f0-9]{3})$/;
    if (primary_color && !colorRegex.test(primary_color)) {
      return res.status(400).json({
        success: false,
        message: 'Invalid primary color format'
      });
    }
    if (secondary_color && !colorRegex.test(secondary_color)) {
      return res.status(400).json({
        success: false,
        message: 'Invalid secondary color format'
      });
    }

    // Update branding
    const updatedBranding = {
      ...tenant.branding,
      logo_url: logo_url || tenant.branding?.logo_url || '',
      primary_color: primary_color || tenant.branding?.primary_color || '#3B82F6',
      secondary_color: secondary_color || tenant.branding?.secondary_color || '#1F2937',
      company_name: company_name || tenant.branding?.company_name || ''
    };

    await tenant.update({ branding: updatedBranding });

    console.log(`✅ Tenant "${tenantId}" branding updated by user "${req.user.username}"`);

    res.json({
      success: true,
      message: 'Branding updated successfully',
      data: { branding: updatedBranding }
    });

  } catch (error) {
    console.error('Error updating tenant branding:', error);
    res.status(500).json({
      success: false,
      message: 'Failed to update branding'
    });
  }
});

/**
 * PUT /tenant/security
 * Update tenant security settings (security admin or higher)
 */
router.put('/security', authenticateToken, requirePermissions(['security.edit']), async (req, res) => {
  try {
    // Determine tenant from request
    const tenantId = await multiAuth.determineTenant(req);
    if (!tenantId) {
      return res.status(400).json({
        success: false,
        message: 'Unable to determine tenant'
      });
    }

    const tenant = await Tenant.findOne({ where: { slug: tenantId } });
    if (!tenant) {
      return res.status(404).json({
        success: false,
        message: 'Tenant not found'
      });
    }

    const { ip_restriction_enabled, ip_whitelist, ip_restriction_message } = req.body;

    // Validate IP whitelist if provided
    if (ip_whitelist && Array.isArray(ip_whitelist)) {
      for (const ip of ip_whitelist) {
        // Basic IP validation (could be enhanced)
        if (typeof ip !== 'string' || ip.trim().length === 0) {
          return res.status(400).json({
            success: false,
            message: 'Invalid IP address in whitelist'
          });
        }
      }
    }

    // Update security settings
    const updates = {};
    if (typeof ip_restriction_enabled === 'boolean') {
      updates.ip_restriction_enabled = ip_restriction_enabled;
    }
    if (ip_whitelist) {
      updates.ip_whitelist = ip_whitelist;
    }
    if (ip_restriction_message) {
      updates.ip_restriction_message = ip_restriction_message;
    }

    await tenant.update(updates);

    console.log(`✅ Tenant "${tenantId}" security settings updated by user "${req.user.username}"`);

    res.json({
      success: true,
      message: 'Security settings updated successfully',
      data: {
        ip_restriction_enabled: tenant.ip_restriction_enabled,
        ip_whitelist: tenant.ip_whitelist,
        ip_restriction_message: tenant.ip_restriction_message
      }
    });

  } catch (error) {
    console.error('Error updating tenant security:', error);
    res.status(500).json({
      success: false,
      message: 'Failed to update security settings'
    });
  }
});

/**
 * GET /tenant/users
 * Get users in current tenant (user admin or higher)
 */
router.get('/users', authenticateToken, requirePermissions(['users.view']), async (req, res) => {
  try {
    // Determine tenant from request
    const tenantId = await multiAuth.determineTenant(req);
    if (!tenantId) {
      return res.status(400).json({
        success: false,
        message: 'Unable to determine tenant'
      });
    }

    const tenant = await Tenant.findOne({ where: { slug: tenantId } });
    if (!tenant) {
      return res.status(404).json({
        success: false,
        message: 'Tenant not found'
      });
    }

    // Get users in this tenant
    const users = await User.findAll({
      where: { tenant_id: tenant.id },
      attributes: ['id', 'username', 'email', 'role', 'is_active', 'last_login', 'created_at'],
      order: [['created_at', 'DESC']]
    });

    res.json({
      success: true,
      data: users
    });

  } catch (error) {
    console.error('Error fetching tenant users:', error);
    res.status(500).json({
      success: false,
      message: 'Failed to fetch users'
    });
  }
});

/**
 * POST /tenant/users
 * Create a new user in current tenant (user admin or higher, local auth only)
 */
router.post('/users', authenticateToken, requirePermissions(['users.create']), async (req, res) => {
  try {
    // Determine tenant from request
    const tenantId = await multiAuth.determineTenant(req);
    if (!tenantId) {
      return res.status(400).json({
        success: false,
        message: 'Unable to determine tenant'
      });
    }

    const tenant = await Tenant.findOne({ where: { slug: tenantId } });
    if (!tenant) {
      return res.status(404).json({
        success: false,
        message: 'Tenant not found'
      });
    }

    // Check if tenant uses local authentication
    if (tenant.auth_provider !== 'local') {
      return res.status(400).json({
        success: false,
        message: `User creation is only available for local authentication. This tenant uses ${tenant.auth_provider}.`
      });
    }

    const { username, email, password, role = 'viewer', is_active = true } = req.body;

    // Validate required fields
    if (!username || !email || !password) {
      return res.status(400).json({
        success: false,
        message: 'Username, email, and password are required'
      });
    }

    // Validate role
    const validRoles = ['admin', 'operator', 'viewer'];
    if (!validRoles.includes(role)) {
      return res.status(400).json({
        success: false,
        message: 'Invalid role. Must be admin, operator, or viewer'
      });
    }

    // Check if username or email already exists in this tenant
    const existingUser = await User.findOne({
      where: {
        tenant_id: tenant.id,
        [require('sequelize').Op.or]: [
          { username },
          { email }
        ]
      }
    });

    if (existingUser) {
      return res.status(400).json({
        success: false,
        message: 'Username or email already exists in this tenant'
      });
    }

    // Create user
    const user = await User.create({
      username,
      email,
      password_hash: password, // Will be hashed by the model
      role,
      is_active,
      tenant_id: tenant.id,
      created_by: req.user.id
    });

    console.log(`✅ User "${username}" created in tenant "${tenantId}" by admin "${req.user.username}"`);

    // Return user data (without password)
    const userData = {
      id: user.id,
      username: user.username,
      email: user.email,
      role: user.role,
      is_active: user.is_active,
      created_at: user.created_at
    };

    res.status(201).json({
      success: true,
      message: 'User created successfully',
      data: userData
    });

  } catch (error) {
    console.error('Error creating tenant user:', error);
    res.status(500).json({
      success: false,
      message: 'Failed to create user'
    });
  }
});

/**
 * PUT /tenant/users/:userId/status
 * Update user status (activate/deactivate) (user admin or higher, local auth only)
 */
router.put('/users/:userId/status', authenticateToken, requirePermissions(['users.edit']), async (req, res) => {
  try {
    // Determine tenant from request
    const tenantId = await multiAuth.determineTenant(req);
    if (!tenantId) {
      return res.status(400).json({
        success: false,
        message: 'Unable to determine tenant'
      });
    }

    const tenant = await Tenant.findOne({ where: { slug: tenantId } });
    if (!tenant) {
      return res.status(404).json({
        success: false,
        message: 'Tenant not found'
      });
    }

    // Check if tenant uses local authentication
    if (tenant.auth_provider !== 'local') {
      return res.status(400).json({
        success: false,
        message: `User management is only available for local authentication. This tenant uses ${tenant.auth_provider}.`
      });
    }

    const { userId } = req.params;
    const { is_active } = req.body;

    if (typeof is_active !== 'boolean') {
      return res.status(400).json({
        success: false,
        message: 'is_active must be a boolean value'
      });
    }

    // Find user in this tenant
    const user = await User.findOne({
      where: {
        id: userId,
        tenant_id: tenant.id
      }
    });

    if (!user) {
      return res.status(404).json({
        success: false,
        message: 'User not found in this tenant'
      });
    }

    // Prevent self-deactivation
    if (user.id === req.user.id && !is_active) {
      return res.status(400).json({
        success: false,
        message: 'You cannot deactivate your own account'
      });
    }

    // Update user status
    await user.update({ is_active });

    console.log(`✅ User "${user.username}" ${is_active ? 'activated' : 'deactivated'} in tenant "${tenantId}" by admin "${req.user.username}"`);

    res.json({
      success: true,
      message: `User ${is_active ? 'activated' : 'deactivated'} successfully`,
      data: {
        id: user.id,
        username: user.username,
        is_active: user.is_active
      }
    });

  } catch (error) {
    console.error('Error updating user status:', error);
    res.status(500).json({
      success: false,
      message: 'Failed to update user status'
    });
  }
});

module.exports = router;