/**
 * First-party session gate for the portal dashboard.
 * Used by email OTP, Konnos (after return), MetaMask, and later mavi wallet.
 *
 * GET  → { authenticated, userId?, method?, email?, walletAddress? }
 * POST → mint krypco_uid (+ optional email / method / wallet cookies)
 * DELETE → clear all portal auth cookies
 */
import { cookies } from "next/headers";
import { NextRequest, NextResponse } from "next/server";

import {
  KRYPCO_UID_COOKIE,
  krypcoUidCookieOptions,
  readCookie,
  signUserId,
  verifyUserIdToken,
} from "@/lib/session-cookie";

export const dynamic = "force-dynamic";

const METHOD_COOKIE = "krypco_method";
const EMAIL_COOKIE = "krypco_email";
const WALLET_COOKIE = "krypco_wallet";

export async function GET(req: NextRequest) {
  const jar = await cookies();
  const access =
    jar.get("sAccessToken")?.value ||
    readCookie(req.headers.get("cookie"), "sAccessToken");
  const uidTok =
    jar.get(KRYPCO_UID_COOKIE)?.value ||
    readCookie(req.headers.get("cookie"), KRYPCO_UID_COOKIE);
  const userId = verifyUserIdToken(uidTok);
  const method =
    jar.get(METHOD_COOKIE)?.value ||
    readCookie(req.headers.get("cookie"), METHOD_COOKIE);
  const email =
    jar.get(EMAIL_COOKIE)?.value ||
    readCookie(req.headers.get("cookie"), EMAIL_COOKIE);
  const walletAddress =
    jar.get(WALLET_COOKIE)?.value ||
    readCookie(req.headers.get("cookie"), WALLET_COOKIE);

  if (access && userId) {
    return NextResponse.json({
      authenticated: true,
      userId,
      method,
      email,
      walletAddress,
      engine: "briven-engine",
    });
  }
  if (access) {
    return NextResponse.json({
      authenticated: true,
      userId: userId || "session",
      method: method || "email",
      email,
      walletAddress,
      engine: "briven-engine",
      soft: !userId,
    });
  }
  if (userId) {
    return NextResponse.json({
      authenticated: true,
      userId,
      method: method || "wallet",
      email,
      walletAddress,
      engine: "portal",
      soft: true,
    });
  }
  return NextResponse.json({ authenticated: false });
}

export async function POST(req: NextRequest) {
  let body: {
    userId?: string;
    email?: string;
    method?: string;
    walletAddress?: string;
  } = {};
  try {
    body = (await req.json()) as typeof body;
  } catch {
    /* empty */
  }
  const userId = String(body.userId || "").trim();
  if (!userId || userId.length < 4) {
    return NextResponse.json(
      { ok: false, code: "invalid_user", message: "userId required." },
      { status: 400 },
    );
  }

  const secure =
    req.nextUrl.protocol === "https:" ||
    process.env.NODE_ENV === "production";
  const opts = krypcoUidCookieOptions(secure);
  const method = (body.method || "email").trim() || "email";
  const res = NextResponse.json({
    ok: true,
    userId,
    authenticated: true,
    method,
    email: body.email ?? null,
    walletAddress: body.walletAddress ?? null,
  });
  res.cookies.set(KRYPCO_UID_COOKIE, signUserId(userId), opts);
  res.cookies.set(METHOD_COOKIE, method, { ...opts, httpOnly: false });
  if (body.email?.includes("@")) {
    res.cookies.set(EMAIL_COOKIE, body.email.trim().toLowerCase(), {
      ...opts,
      httpOnly: false,
    });
  }
  if (body.walletAddress?.startsWith("0x")) {
    res.cookies.set(WALLET_COOKIE, body.walletAddress, {
      ...opts,
      httpOnly: false,
    });
  }
  return res;
}

export async function DELETE(req: NextRequest) {
  const secure =
    req.nextUrl.protocol === "https:" ||
    process.env.NODE_ENV === "production";
  const opts = { ...krypcoUidCookieOptions(secure), maxAge: 0 };
  const res = NextResponse.json({ ok: true });
  res.cookies.set(KRYPCO_UID_COOKIE, "", opts);
  res.cookies.set(EMAIL_COOKIE, "", { ...opts, httpOnly: false });
  res.cookies.set(METHOD_COOKIE, "", { ...opts, httpOnly: false });
  res.cookies.set(WALLET_COOKIE, "", { ...opts, httpOnly: false });
  return res;
}