// 2026-11-10: Super Admin "Login as user". The admin's own session is parked in localStorage
// (impersonator_*) and restored by "Return to my account". No password is ever read or changed.
import { useAuthStore } from "@/store/authStore";

const API = process.env.NEXT_PUBLIC_API_BASE_URL || process.env.NEXT_PUBLIC_API_URL || "http://localhost:3007/api";

const K_TOKEN = "impersonator_token";
const K_USER = "impersonator_user";
const K_INFO = "impersonation_info";

function currentToken(): string | null {
  if (typeof window === "undefined") return null;
  return sessionStorage.getItem("access_token") || localStorage.getItem("access_token");
}

function tokenPayload(token: string | null): any {
  try {
    if (!token) return null;
    const b64 = token.split(".")[1].replace(/-/g, "+").replace(/_/g, "/");
    return JSON.parse(decodeURIComponent(escape(atob(b64))));
  } catch {
    return null;
  }
}

const norm = (v: any) => String(v || "").toLowerCase().replace(/[\s_-]+/g, "");

/** True when the person logged in right now is a Super Admin (and is not impersonating). */
export function isSuperAdminSession(): boolean {
  const p = tokenPayload(currentToken());
  if (!p || p.impersonated_by) return false;
  return (p.roleNames || []).some((r: string) => norm(r) === "superadmin");
}

export function getImpersonation(): { targetName: string; adminName: string } | null {
  if (typeof window === "undefined") return null;
  if (!localStorage.getItem(K_TOKEN)) return null;
  try {
    return JSON.parse(localStorage.getItem(K_INFO) || "null");
  } catch {
    return { targetName: "another user", adminName: "" };
  }
}

export async function loginAsUser(userId: number, displayName: string): Promise<void> {
  const adminToken = currentToken();
  if (!adminToken) throw new Error("Your session has expired. Please log in again.");
  const res = await fetch(`${API}/auth/impersonate/${userId}`, {
    method: "POST",
    headers: { "Content-Type": "application/json", Authorization: `Bearer ${adminToken}` },
  });
  const data = await res.json().catch(() => ({}));
  if (!res.ok) throw new Error(data?.message || "Could not log in as this user.");

  // park the admin's own session (only the first time — never overwrite it with a user's)
  if (!localStorage.getItem(K_TOKEN)) {
    localStorage.setItem(K_TOKEN, adminToken);
    localStorage.setItem(K_USER, sessionStorage.getItem("user") || localStorage.getItem("user") || "null");
  }
  const u = data.user || {};
  const targetName = `${u.firstName || ""} ${u.lastName || ""}`.trim() || u.email || displayName;
  localStorage.setItem(K_INFO, JSON.stringify({ targetName, targetEmail: u.email, adminName: data.impersonator?.name || "" }));

  useAuthStore.getState().login(data.access_token, {
    username: targetName,
    role: u.roles?.[0]?.name || "User",
  });
  sessionStorage.setItem("access_token", data.access_token);
  window.location.replace("/dashboard");
}

/** Restore the Super Admin's own session. Returns false when there is nothing to restore. */
export function returnToMyAccount(redirect = true): boolean {
  if (typeof window === "undefined") return false;
  const adminToken = localStorage.getItem(K_TOKEN);
  if (!adminToken) return false;
  let adminUser: any = null;
  try {
    adminUser = JSON.parse(localStorage.getItem(K_USER) || "null");
  } catch {}
  localStorage.removeItem(K_TOKEN);
  localStorage.removeItem(K_USER);
  localStorage.removeItem(K_INFO);
  useAuthStore.getState().login(adminToken, adminUser || { username: "Admin", role: "Super-admin" });
  sessionStorage.setItem("access_token", adminToken);
  if (redirect) window.location.replace("/modules/users");
  return true;
}

export function clearImpersonation() {
  if (typeof window === "undefined") return;
  localStorage.removeItem(K_TOKEN);
  localStorage.removeItem(K_USER);
  localStorage.removeItem(K_INFO);
}