import { randomUUID } from "node:crypto";
import { NextResponse } from "next/server";
import { getDbPool } from "@/db";
import { getSession } from "@/lib/auth";
import { ensureDefaultRuleSets } from "@/lib/default-rules";

export const runtime = "nodejs";
const slugify = (value: string) => value.toLowerCase().normalize("NFD").replace(/[\u0300-\u036f]/g, "").replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
const clean = (value: unknown, max = 200) => String(value || "").trim().slice(0, max);
const digits = (value: unknown) => String(value || "").replace(/\D/g, "");
function profile(body: Record<string, unknown>) {
  const cnpj = digits(body.cnpj);
  const email = clean(body.email, 190).toLowerCase();
  const state = clean(body.addressState, 2).toUpperCase();
  if (cnpj && cnpj.length !== 14) throw new Error("Informe um CNPJ com 14 dígitos.");
  if (email && !/^\S+@\S+\.\S+$/.test(email)) throw new Error("Informe um e-mail corporativo válido.");
  if (state && !/^[A-Z]{2}$/.test(state)) throw new Error("Informe a UF com duas letras.");
  return { legalName: clean(body.legalName), cnpj: cnpj || null, email: email || null, phone: clean(body.phone, 30) || null, postalCode: clean(body.postalCode, 12) || null, street: clean(body.addressStreet) || null, number: clean(body.addressNumber, 30) || null, complement: clean(body.addressComplement, 100) || null, district: clean(body.addressDistrict, 100) || null, city: clean(body.addressCity, 100) || null, state: state || null };
}
function errorMessage(error: unknown) { const code = typeof error === "object" && error && "code" in error ? String(error.code) : ""; if (code === "ER_DUP_ENTRY") return "Já existe uma empresa cadastrada com este identificador ou CNPJ."; if (error instanceof Error) return error.message; return "Não foi possível salvar os dados da empresa."; }
async function admin() { const session = await getSession(); return session?.role === "capital_admin" ? session : null; }

export async function GET() {
  if (!await admin()) return NextResponse.json({ error: "Sem permissão." }, { status: 403 });
  try {
    const [rows] = await getDbPool().execute(`SELECT t.id, t.name, t.legal_name, t.cnpj, t.email, t.phone, t.postal_code, t.address_street, t.address_number, t.address_complement, t.address_district, t.address_city, t.address_state, t.slug, t.status, p.client_can_view_photos, p.client_can_manual_review, p.client_can_download_report FROM tenants t LEFT JOIN tenant_access_profiles p ON p.tenant_id = t.id ORDER BY t.created_at DESC`);
    return NextResponse.json({ clients: rows });
  } catch (error) { console.error("Erro ao listar clientes", error); return NextResponse.json({ error: "O cadastro empresarial ainda não foi atualizado.", hint: "Execute a migration 015_tenant_company_profile.sql." }, { status: 503 }); }
}

export async function POST(request: Request) {
  if (!await admin()) return NextResponse.json({ error: "Sem permissão." }, { status: 403 });
  try {
    const body = await request.json() as Record<string, unknown>;
    const name = clean(body.name, 160), slug = slugify(clean(body.slug || name, 90));
    if (!name || !slug) return NextResponse.json({ error: "Informe o nome da empresa." }, { status: 400 });
    const data = profile(body), db = getDbPool(), id = randomUUID();
    await db.execute(`INSERT INTO tenants (id, name, legal_name, cnpj, email, phone, postal_code, address_street, address_number, address_complement, address_district, address_city, address_state, slug, status) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'active')`, [id, name, data.legalName || null, data.cnpj, data.email, data.phone, data.postalCode, data.street, data.number, data.complement, data.district, data.city, data.state, slug]);
    await db.execute("INSERT INTO tenant_access_profiles (tenant_id, client_can_view_photos, client_can_manual_review, client_can_download_report) VALUES (?, ?, ?, ?)", [id, Boolean(body.photos), Boolean(body.manual), Boolean(body.report)]);
    await ensureDefaultRuleSets(id);
    return NextResponse.json({ message: "Cliente cadastrado com perfil empresarial e regras padrão." }, { status: 201 });
  } catch (error) { return NextResponse.json({ error: errorMessage(error) }, { status: 400 }); }
}