import { after, NextResponse } from "next/server";
import { z } from "zod";
import { exchangeWooSso, isFreshWooSsoIssue, verifyWooSsoPayload, verifyWooSsoRequest } from "@/lib/auth/woo-sso";
import { setSessionCookie } from "@/lib/auth/session";
import { BillingInterval, SubscriptionStatus } from "@prisma/client";
import { syncWooEntitlement } from "@/lib/billing/woo-entitlement";
import { appUrl } from "@/lib/app-url";
import { syncOrganizationLicenses } from "@/lib/site-agent/license-sync";

const exchangeSchema = z.object({
  customerId: z.string().trim().min(1).max(100),
  email: z.string().trim().email().max(254),
  name: z.string().trim().max(100).optional(),
  organizationName: z.string().trim().max(100).optional(),
  nonce: z.string().trim().min(16).max(256),
  issuedAt: z.string().datetime(),
  subscription: z.object({
    providerSubscriptionId: z.string().trim().min(1).max(100),
    planCode: z.string().trim().min(1).max(64),
    status: z.nativeEnum(SubscriptionStatus),
    billingInterval: z.nativeEnum(BillingInterval),
    currentPeriodEnd: z.string().datetime().nullable().optional(),
    trialEndsAt: z.string().datetime().nullable().optional(),
  }).optional(),
});

export async function POST(request: Request) {
  const rawBody = await request.text();

  let rawPayload: unknown;

  if (verifyWooSsoRequest(request, rawBody)) {
    try {
      rawPayload = JSON.parse(rawBody);
    } catch {
      return NextResponse.json({ message: "Invalid WooCommerce sign-in request." }, { status: 400 });
    }
  } else {
    const form = new URLSearchParams(rawBody);
    const encodedPayload = form.get("payload");
    const signature = form.get("signature");

    if (!encodedPayload || !signature) return NextResponse.json({ message: "Invalid WooCommerce sign-in request." }, { status: 401 });

    try {
      const decodedPayload = Buffer.from(encodedPayload, "base64url").toString("utf8");
      if (!verifyWooSsoPayload(decodedPayload, signature)) return NextResponse.json({ message: "Invalid WooCommerce sign-in request." }, { status: 401 });
      rawPayload = JSON.parse(decodedPayload);
    } catch {
      return NextResponse.json({ message: "Invalid WooCommerce sign-in request." }, { status: 400 });
    }
  }
  const input = exchangeSchema.safeParse(rawPayload);
  if (!input.success || !isFreshWooSsoIssue(input.data.issuedAt)) return NextResponse.json({ message: "This WooCommerce sign-in link has expired." }, { status: 400 });

  try {
    const account = await exchangeWooSso(input.data);
    if (input.data.subscription) {
      await syncWooEntitlement(account, { ...input.data, ...input.data.subscription });
      after(async () => {
        try { await syncOrganizationLicenses(account.organizationId); }
        catch { console.error("License sync after WooCommerce sign-in failed."); }
      });
    }
    const response = NextResponse.redirect(appUrl("/overview"), 303);
    setSessionCookie(response, account);
    return response;
  } catch (error) {
    const message = error instanceof Error ? error.message : "Unable to complete WooCommerce sign-in.";
    return NextResponse.json({ message }, { status: message.includes("already been used") ? 409 : 500 });
  }
}