import { NextResponse } from "next/server";
import { auth } from "@/lib/auth";
import { prisma } from "@/lib/prisma";
import { generateApiKey, prepareKey, API_SCOPES } from "@/lib/api-auth";

export async function GET() {
  const session = await auth();
  if (!session?.user?.id) return NextResponse.json({ error: "Non autorisé" }, { status: 401 });
  const familyId = (session.user as { familyId?: string }).familyId;
  if (!familyId) return NextResponse.json({ keys: [] });

  const keys = await prisma.apiKey.findMany({
    where: { familyId },
    orderBy: { createdAt: "desc" },
    select: { id: true, name: true, keyPrefix: true, scopes: true, lastUsedAt: true, createdAt: true },
  });

  return NextResponse.json({ keys });
}

export async function POST(req: Request) {
  const session = await auth();
  if (!session?.user?.id) return NextResponse.json({ error: "Non autorisé" }, { status: 401 });
  const familyId = (session.user as { familyId?: string }).familyId;
  if (!familyId) return NextResponse.json({ error: "Famille introuvable" }, { status: 400 });

  const body = await req.json().catch(() => ({}));
  const { name, scopes } = body;

  if (!name?.trim()) return NextResponse.json({ error: "name is required" }, { status: 400 });

  const validScopes = (scopes as string[] | undefined)?.filter((s) => (API_SCOPES as readonly string[]).includes(s));
  if (!validScopes?.length) return NextResponse.json({ error: "At least one valid scope is required" }, { status: 400 });

  const token = generateApiKey();
  const data = prepareKey(token, name.trim(), familyId, validScopes);

  const key = await prisma.apiKey.create({
    data,
    select: { id: true, name: true, keyPrefix: true, scopes: true, createdAt: true },
  });

  // Return the raw token ONCE — it cannot be retrieved again
  return NextResponse.json({ key, token }, { status: 201 });
}