import { NextResponse } from "next/server";
import { sql } from "@/db";
import { requireFamily } from "@/lib/auth";
import { S3Client, PutObjectCommand, DeleteObjectCommand } from "@aws-sdk/client-s3";
import { getSignedUrl } from "@aws-sdk/s3-request-presigner";

const ALLOWED_TYPES = ["image/jpeg", "image/jpg", "image/png", "image/webp", "image/heic"];

async function ownershipCheck(childId: string, familyId: string) {
  const rows = await sql.unsafe(
    `SELECT id FROM children WHERE id = $1 AND family_id = $2`,
    [childId, familyId]
  );
  return rows.length > 0;
}

// POST — get a presigned R2 URL for uploading a child profile photo
//         (no memories row — this is purely for profile avatars)
export async function POST(
  request: Request,
  { params }: { params: Promise<{ id: string }> }
) {
  const auth = await requireFamily();
  if (!auth.success) return NextResponse.json({ error: auth.error }, { status: auth.status });

  const familyId = auth.session!.familyId!;
  const { id } = await params;

  if (!(await ownershipCheck(id, familyId))) {
    return NextResponse.json({ error: "Not found" }, { status: 404 });
  }

  const body = await request.json();
  const { contentType, filename } = body;

  if (!contentType || !ALLOWED_TYPES.includes(contentType)) {
    return NextResponse.json({ error: "Unsupported file type" }, { status: 400 });
  }

  const accountId  = process.env.R2_ACCOUNT_ID;
  const accessKeyId = process.env.R2_ACCESS_KEY_ID;
  const secretKey  = process.env.R2_SECRET_ACCESS_KEY;
  const bucket     = process.env.R2_BUCKET_NAME;
  const publicUrl  = process.env.R2_PUBLIC_URL;

  if (!accountId || !accessKeyId || !secretKey || !bucket) {
    return NextResponse.json({ error: "R2 not configured" }, { status: 500 });
  }

  const ext    = filename?.split(".").pop()?.toLowerCase() || "jpg";
  const r2Key  = `profiles/${id}/${Date.now()}.${ext}`;
  const baseUrl = publicUrl || `https://pub-${accountId}.r2.dev`;

  const client = new S3Client({
    region: "auto",
    endpoint: `https://${accountId}.r2.cloudflarestorage.com`,
    credentials: { accessKeyId, secretAccessKey: secretKey },
  });

  const uploadUrl = await getSignedUrl(
    client,
    new PutObjectCommand({ Bucket: bucket, Key: r2Key, ContentType: contentType }),
    { expiresIn: 3600 }
  );

  return NextResponse.json({ uploadUrl, key: r2Key, publicUrl: `${baseUrl}/${r2Key}` });
}

// PATCH — update child profile fields (imageUrl, and extensible for name/etc later)
export async function PATCH(
  request: Request,
  { params }: { params: Promise<{ id: string }> }
) {
  const auth = await requireFamily();
  if (!auth.success) return NextResponse.json({ error: auth.error }, { status: auth.status });

  const familyId = auth.session!.familyId!;
  const { id } = await params;

  if (!(await ownershipCheck(id, familyId))) {
    return NextResponse.json({ error: "Not found" }, { status: 404 });
  }

  const body = await request.json();
  const { imageUrl } = body; // may be a URL string or null (to remove)

  if (imageUrl !== undefined) {
    // Fetch the current image URL so we can delete it from R2 after update
    const existing = await sql.unsafe(
      `SELECT image_url FROM children WHERE id = $1`,
      [id]
    );
    const oldImageUrl: string | null = existing[0]?.image_url ?? null;

    // Update DB (imageUrl === null clears the photo)
    await sql.unsafe(
      `UPDATE children SET image_url = $1 WHERE id = $2`,
      [imageUrl ?? null, id]
    );

    // Delete old R2 object if it's a profiles/ key (not an external URL)
    if (oldImageUrl && oldImageUrl !== imageUrl) {
      try {
        const accountId  = process.env.R2_ACCOUNT_ID;
        const accessKeyId = process.env.R2_ACCESS_KEY_ID;
        const secretKey  = process.env.R2_SECRET_ACCESS_KEY;
        const bucket     = process.env.R2_BUCKET_NAME;
        const baseUrl    = process.env.R2_PUBLIC_URL || `https://pub-${accountId}.r2.dev`;
        if (accountId && accessKeyId && secretKey && bucket && oldImageUrl.startsWith(baseUrl + "/")) {
          const oldKey = oldImageUrl.slice(baseUrl.length + 1);
          if (oldKey.startsWith("profiles/")) {
            const client = new S3Client({
              region: "auto",
              endpoint: `https://${accountId}.r2.cloudflarestorage.com`,
              credentials: { accessKeyId, secretAccessKey: secretKey },
            });
            await client.send(new DeleteObjectCommand({ Bucket: bucket, Key: oldKey }));
          }
        }
      } catch (e) {
        console.error("Failed to delete old profile image from R2:", e);
        // Non-fatal — DB is already updated
      }
    }
  }

  return NextResponse.json({ success: true });
}
