import { logApiError } from "@/lib/api/security";
import { NextResponse } from "next/server";
import { encryptSecret } from "@/lib/ai/crypto";
import { canManageWorkspace } from "@/lib/developers/auth";
import {
  exchangeGoogleWorkspaceCode,
  getGoogleDriveProfile,
  getGoogleWorkspaceRedirectUri,
  parseGoogleWorkspaceState,
} from "@/lib/integrations/google-workspace";
import { createAdminClient } from "@/lib/supabase/admin";
import { createRouteClient } from "@/lib/supabase/route";
import type { IntegrationConnection } from "@/types";

function integrationsRedirect(req: Request, status: string) {
  return new URL(
    `/integrations?googleDrive=${encodeURIComponent(status)}`,
    new URL(req.url).origin
  );
}

export async function GET(req: Request) {
  try {
    const url = new URL(req.url);
    if (url.searchParams.get("error")) {
      return NextResponse.redirect(integrationsRedirect(req, "oauth_error"));
    }

    const code = url.searchParams.get("code");
    const stateValue = url.searchParams.get("state");
    if (!code || !stateValue) {
      return NextResponse.redirect(integrationsRedirect(req, "missing_code"));
    }

    const state = parseGoogleWorkspaceState(stateValue);
    if (Date.now() - state.issuedAt > 15 * 60 * 1000) {
      return NextResponse.redirect(integrationsRedirect(req, "state_expired"));
    }

    const supabase = await createRouteClient();
    const {
      data: { user },
    } = await supabase.auth.getUser();

    if (!user || user.id !== state.userId) {
      return NextResponse.redirect(integrationsRedirect(req, "session_mismatch"));
    }

    const manageable = await canManageWorkspace(user.id, state.teamId);
    if (!manageable) {
      return NextResponse.redirect(integrationsRedirect(req, "forbidden"));
    }

    const redirectUri = getGoogleWorkspaceRedirectUri("google_drive", new URL(req.url).origin);
    const credentials = await exchangeGoogleWorkspaceCode({ code, redirectUri });
    const admin = createAdminClient();
    const tempConnection = {
      id: "temp-google-drive",
      user_id: user.id,
      team_id: state.teamId,
      provider: "google_drive",
      name: "Google Drive",
      config: {},
      event_types: [],
      is_active: true,
      last_delivery_at: null,
      last_response_status: null,
      last_error: null,
      created_at: new Date().toISOString(),
      updated_at: new Date().toISOString(),
      secret_encrypted: encryptSecret(JSON.stringify(credentials)),
    } satisfies IntegrationConnection & { secret_encrypted: string };

    const profile = await getGoogleDriveProfile(admin, tempConnection);
    const nextSecret = encryptSecret(
      JSON.stringify({
        ...credentials,
        connected_email: profile.connectedEmail,
      })
    );

    let existingQuery = admin
      .from("integration_connections")
      .select("id")
      .eq("provider", "google_drive")
      .limit(1);
    existingQuery = state.teamId
      ? existingQuery.eq("team_id", state.teamId)
      : existingQuery.eq("user_id", user.id).is("team_id", null);

    const { data: existing } = await existingQuery.maybeSingle();

    if (existing) {
      await admin
        .from("integration_connections")
        .update({
          secret_encrypted: nextSecret,
          is_active: true,
          config: {
            connectedEmail: profile.connectedEmail,
          },
        })
        .eq("id", existing.id);
    } else {
      await admin.from("integration_connections").insert({
        user_id: user.id,
        team_id: state.teamId,
        provider: "google_drive",
        name: state.teamId ? "Team Google Drive" : "Personal Google Drive",
        config: {
          connectedEmail: profile.connectedEmail,
        },
        secret_encrypted: nextSecret,
        event_types: [],
        is_active: true,
      });
    }

    return NextResponse.redirect(integrationsRedirect(req, "connected"));
  } catch (error) {
    logApiError("Google Drive callback error:", error);
    return NextResponse.redirect(integrationsRedirect(req, "connect_failed"));
  }
}