import { NextRequest, NextResponse } from 'next/server'
import { getUserSession } from '@/lib/auth/permissions'
import { isAtLeastRole } from '@/lib/auth/permissions-shared'
import { createClient } from '@/lib/supabase/server'

export async function GET(request: NextRequest) {
  const session = await getUserSession()
  if (!session) {
    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
  }
  if (!isAtLeastRole(session, 'admin')) {
    return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
  }

  const { searchParams } = new URL(request.url)
  const offset      = parseInt(searchParams.get('offset') ?? '0', 10)
  const limit       = Math.min(parseInt(searchParams.get('limit') ?? '50', 10), 200)
  const action      = searchParams.get('action')
  const actorId     = searchParams.get('actorId')
  const targetUserId = searchParams.get('targetUserId')
  const from        = searchParams.get('from')
  const to          = searchParams.get('to')

  const supabase = await createClient()

  let query = supabase
    .from('user_audit_log')
    .select('id, created_at, actor_id, target_user_id, action, details, ip_address')
    .order('created_at', { ascending: false })
    .range(offset, offset + limit - 1)

  if (action) {
    const actions = action.split(',').filter(Boolean)
    if (actions.length === 1) {
      query = query.eq('action', actions[0])
    } else if (actions.length > 1) {
      query = query.in('action', actions)
    }
  }
  if (actorId)      query = query.eq('actor_id', actorId)
  if (targetUserId) query = query.eq('target_user_id', targetUserId)
  if (from)         query = query.gte('created_at', from)
  if (to)           query = query.lte('created_at', to + 'T23:59:59')

  const { data: rawEntries, error } = await query

  if (error) {
    return NextResponse.json({ error: error.message }, { status: 500 })
  }

  const entries = rawEntries ?? []

  // Batch-fetch profiles for actor and target
  const profileIds = new Set<string>()
  for (const e of entries) {
    if (e.actor_id)      profileIds.add(e.actor_id as string)
    if (e.target_user_id) profileIds.add(e.target_user_id as string)
  }

  const idList = Array.from(profileIds)
  const { data: profiles } = idList.length > 0
    ? await supabase
        .from('user_profiles')
        .select('id, display_name, email')
        .in('id', idList)
    : { data: [] }

  const profileMap = new Map<string, { display_name: string; email: string }>()
  for (const p of profiles ?? []) {
    profileMap.set(p.id as string, {
      display_name: p.display_name as string,
      email: p.email as string,
    })
  }

  const enriched = entries.map((e) => ({
    id:                   e.id as number,
    created_at:           e.created_at as string,
    actor_id:             (e.actor_id as string | null) ?? null,
    target_user_id:       (e.target_user_id as string | null) ?? null,
    action:               e.action as string,
    details:              (e.details as Record<string, unknown> | null) ?? null,
    ip_address:           (e.ip_address as string | null) ?? null,
    actor_display_name:   e.actor_id ? (profileMap.get(e.actor_id as string)?.display_name ?? null) : null,
    target_display_name:  e.target_user_id ? (profileMap.get(e.target_user_id as string)?.display_name ?? null) : null,
    target_email:         e.target_user_id ? (profileMap.get(e.target_user_id as string)?.email ?? null) : null,
  }))

  return NextResponse.json(enriched)
}