import { Router } from "express";
import { z } from "zod";
import { isSystemAdmin } from "../lib/authz";
import { prisma } from "../lib/prisma";
import { getDefaultRedirectUri, getMicrosoftAppConfig, saveMicrosoftAppConfig } from "../lib/microsoftGraph";
import { HttpError } from "../middleware/errorHandler";
import { requireAuth } from "../middleware/requireAuth";

export const integrationsRouter = Router();
integrationsRouter.use(requireAuth);

async function requireSystemAdmin(userId: string) {
  if (!(await isSystemAdmin(userId))) {
    throw new HttpError(403, "Only system admins can manage integrations");
  }
}

integrationsRouter.get("/microsoft", async (req, res, next) => {
  try {
    await requireSystemAdmin(req.userId!);
    const settings = await prisma.integrationSettings.findUnique({ where: { id: "singleton" } });
    res.json({
      configured: !!(settings?.microsoftClientId && settings.microsoftClientSecret),
      clientId: settings?.microsoftClientId ?? "",
      redirectUri: getDefaultRedirectUri(),
    });
  } catch (err) {
    next(err);
  }
});

const configSchema = z.object({
  clientId: z.string().min(1),
  clientSecret: z.string().optional(),
});

integrationsRouter.put("/microsoft", async (req, res, next) => {
  try {
    await requireSystemAdmin(req.userId!);
    const data = configSchema.parse(req.body);

    let clientSecret = data.clientSecret;
    if (!clientSecret) {
      const existing = await getMicrosoftAppConfig();
      if (!existing) throw new HttpError(400, "Client secret is required");
      clientSecret = existing.clientSecret;
    }

    await saveMicrosoftAppConfig({ clientId: data.clientId, clientSecret });
    res.json({ configured: true, clientId: data.clientId, redirectUri: getDefaultRedirectUri() });
  } catch (err) {
    next(err);
  }
});