import { NextResponse } from "next/server";
import { prisma } from "@/lib/prisma";
import { requireRole } from "@/lib/auth";
import { SMS_PACKAGES } from "@/lib/constants";

/** Communication integrations (SMS gateway / SMTP / WhatsApp) for this institution. */
export async function GET() {
  const session = await requireRole("INSTITUTION_ADMIN");
  if (!session || !session.institutionId) {
    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
  }

  const setting =
    (await prisma.commSetting.findUnique({
      where: { institutionId: session.institutionId },
    })) ??
    (await prisma.commSetting.create({
      data: { institutionId: session.institutionId },
    }));

  return NextResponse.json({
    setting: {
      smsApiUrl: setting.smsApiUrl,
      smsApiKey: setting.smsApiKey ? "••••" + setting.smsApiKey.slice(-4) : null,
      smsApiKeySet: !!setting.smsApiKey,
      smsSenderId: setting.smsSenderId,
      smsType: setting.smsType,
      smsBalance: setting.smsBalance,
      smtpHost: setting.smtpHost,
      smtpPort: setting.smtpPort,
      smtpUser: setting.smtpUser,
      smtpFromName: setting.smtpFromName,
      smtpFromEmail: setting.smtpFromEmail,
      smtpSecure: setting.smtpSecure,
      waApiUrl: setting.waApiUrl,
      waPhoneId: setting.waPhoneId,
      updatedAt: setting.updatedAt,
    },
    packages: SMS_PACKAGES,
  });
}

/** Save integration settings (empty secret fields keep the stored value). */
export async function PUT(req: Request) {
  const session = await requireRole("INSTITUTION_ADMIN");
  if (!session || !session.institutionId) {
    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
  }

  try {
    const body = await req.json();
    const str = (v: unknown) => (typeof v === "string" && v.trim() ? v.trim() : null);
    const secret = (v: unknown) =>
      typeof v === "string" && v.trim() && !v.startsWith("••••") ? v.trim() : undefined;

    const data = {
      smsApiUrl: str(body.smsApiUrl),
      smsApiKey: secret(body.smsApiKey),
      smsSenderId: str(body.smsSenderId),
      smsType: body.smsType === "MASKING" ? ("MASKING" as const) : ("NON_MASKING" as const),
      smtpHost: str(body.smtpHost),
      smtpPort: body.smtpPort ? Number(body.smtpPort) : null,
      smtpUser: str(body.smtpUser),
      smtpPass: secret(body.smtpPass),
      smtpFromName: str(body.smtpFromName),
      smtpFromEmail: str(body.smtpFromEmail),
      smtpSecure: body.smtpSecure !== undefined ? Boolean(body.smtpSecure) : undefined,
      waApiUrl: str(body.waApiUrl),
      waApiKey: secret(body.waApiKey),
      waPhoneId: str(body.waPhoneId),
    };

    // Strip undefined values (Prisma treats undefined as "keep")
    const clean = Object.fromEntries(
      Object.entries(data).filter(([, v]) => v !== undefined)
    );

    await prisma.commSetting.upsert({
      where: { institutionId: session.institutionId },
      update: clean,
      create: { institutionId: session.institutionId, ...clean },
    });

    return NextResponse.json({ success: true });
  } catch {
    return NextResponse.json({ error: "Could not save settings" }, { status: 500 });
  }
}