import { cookies } from "next/headers";
import { redirect } from "next/navigation";
import { Role } from "@prisma/client";
import { prisma } from "@/server/db";
import { hasRole } from "@/server/security/rbac";
import { verifyAccessToken } from "@/server/security/jwt";

export async function requireAffiliatePage() {
  const auth = await getAffiliationPageAuth();
  if (!auth) redirect("/affiliation/login");

  const account = await prisma.affiliateAccount.findUnique({
    where: { userId: auth.user.id },
    include: { defaultOffer: true }
  });

  if (!account) redirect("/affiliation/register");
  return { ...auth, account };
}

export async function requireAffiliateAdminPage() {
  const auth = await getAffiliationPageAuth();
  if (!auth) redirect("/affiliation/login");
  if (!hasRole(auth.roles, [Role.ADMIN, Role.SUPER_ADMIN])) redirect("/affiliation/dashboard");
  return auth;
}

async function getAffiliationPageAuth() {
  const cookieStore = await cookies();
  const token = cookieStore.get("access_token")?.value;
  if (!token) return null;

  try {
    const claims = await verifyAccessToken(token);
    const session = await prisma.session.findFirst({
      where: {
        id: claims.sessionId,
        userId: claims.sub,
        revokedAt: null,
        expiresAt: { gt: new Date() }
      }
    });

    if (!session) return null;

    const user = await prisma.user.findUnique({
      where: { id: claims.sub },
      include: { profile: true }
    });

    if (!user) return null;
    return { user, session, roles: claims.roles };
  } catch {
    return null;
  }
}