import { Router, type IRouter } from 'express';
import { users, addAuditEvent } from '../data/store';

const router: IRouter = Router();

router.post('/auth/login', async (req, res) => {
  const { username, password } = req.body as { username?: string; password?: string };
  if (!username || !password) {
    return res.status(400).json({ error: 'Username and password required' });
  }
  const user = users.find(
    (u) => u.username === username && u.password === password && u.status !== 'Disabled',
  );
  if (!user) {
    await addAuditEvent('Failed login', username, 'Unknown',
      'Invalid credentials or disabled account',
      { username, ip: req.ip ?? null, userAgent: req.get('user-agent') ?? null });
    return res.status(401).json({ error: 'Invalid credentials' });
  }
  req.session.userId = user.id;
  user.lastLogin = new Date().toLocaleString('en-GB', {
    day: '2-digit', month: 'short', year: 'numeric',
    hour: '2-digit', minute: '2-digit', timeZone: 'UTC',
  }) + ' UTC';
  await addAuditEvent('User login', user.username, user.name,
    `Successful login for ${user.role} account`,
    { userId: user.id, role: user.role, status: user.status, ip: req.ip ?? null, userAgent: req.get('user-agent') ?? null });
  const { password: _pw, ...publicUser } = user;
  return res.json(publicUser);
});

router.post('/auth/logout', async (req, res) => {
  const user = users.find((candidate) => candidate.id === req.session?.userId);
  if (user) {
    await addAuditEvent('User logout', user.username, user.name,
      `Logged out ${user.role} account`,
      { userId: user.id, role: user.role, ip: req.ip ?? null, userAgent: req.get('user-agent') ?? null });
  }
  req.session.destroy(() => {
    res.json({ ok: true });
  });
});

router.get('/auth/me', (req, res) => {
  const uid = req.session?.userId;
  if (!uid) return res.status(401).json({ error: 'Not authenticated' });
  const user = users.find((u) => u.id === uid);
  if (!user) return res.status(401).json({ error: 'User not found' });
  const { password: _pw, ...publicUser } = user;
  return res.json(publicUser);
});

export default router;