/**
 * Staff Authentication Utilities
 *
 * Role-based access control for staff dashboard
 */

import { redirect } from 'next/navigation';
import { auth } from './auth';
import { getStaffSession as getCustomStaffSession } from './staff-session';

export type UserRole = 'CUSTOMER' | 'STAFF' | 'ADMIN' | 'SUPER_ADMIN';

/**
 * Get current staff session
 */
export async function getStaffSession() {
  return await getCustomStaffSession();
}

/**
 * Require staff authentication (STAFF, ADMIN, or SUPER_ADMIN)
 * Redirects to staff login if not authenticated or not staff
 */
export async function requireStaffAuth() {
  const session = await auth();
  const user = await getStaffSession();

  if (!session?.user) {
    redirect('/en/clerk-login?redirect_url=%2Fstaff%2Fdashboard');
  }

  if (!user) {
    redirect('/en/dashboard?error=staff_access_required');
  }

  if (user.role === 'CUSTOMER') {
    redirect('/en/dashboard?error=staff_access_required');
  }

  if (!user.isActive) {
    redirect('/en/dashboard?error=staff_inactive');
  }

  return user;
}

/**
 * Require admin authentication (ADMIN or SUPER_ADMIN)
 */
export async function requireAdminAuth() {
  const user = await requireStaffAuth();

  if (user.role !== 'ADMIN' && user.role !== 'SUPER_ADMIN') {
    redirect('/staff/dashboard?error=insufficient_permissions');
  }

  return user;
}

/**
 * Require super admin authentication
 */
export async function requireSuperAdminAuth() {
  const user = await requireStaffAuth();

  if (user.role !== 'SUPER_ADMIN') {
    redirect('/staff/dashboard?error=insufficient_permissions');
  }

  return user;
}

/**
 * Check if user has specific role
 */
export function hasRole(user: { role: string }, requiredRole: UserRole): boolean {
  const roleHierarchy: Record<UserRole, number> = {
    CUSTOMER: 0,
    STAFF: 1,
    ADMIN: 2,
    SUPER_ADMIN: 3,
  };

  return roleHierarchy[user.role as UserRole] >= roleHierarchy[requiredRole];
}

/**
 * Check if user can perform action
 */
export function canPerformAction(user: { role: string }, action: string): boolean {
  const permissions: Record<UserRole, string[]> = {
    CUSTOMER: [],
    STAFF: [
      'view_demos',
      'view_contacts',
      'view_users',
      'view_analytics',
      'view_support',
      'add_notes',
      'update_demo_status',
      'update_contact_status',
      'send_emails',
    ],
    ADMIN: [
      'view_demos',
      'view_contacts',
      'view_users',
      'view_analytics',
      'view_support',
      'manage_support',
      'view_security',
      'view_integrations',
      'add_notes',
      'update_demo_status',
      'update_contact_status',
      'send_emails',
      'export_data',
      'manage_users',
      'view_revenue',
      'delete_records',
    ],
    SUPER_ADMIN: [
      'view_demos',
      'view_contacts',
      'view_users',
      'view_analytics',
      'view_support',
      'manage_support',
      'view_security',
      'view_integrations',
      'add_notes',
      'update_demo_status',
      'update_contact_status',
      'send_emails',
      'export_data',
      'manage_users',
      'view_revenue',
      'delete_records',
      'manage_staff',
      'system_settings',
    ],
  };

  const userPermissions = permissions[user.role as UserRole] || [];
  return userPermissions.includes(action);
}
