import { randomUUID } from "node:crypto";
import { NextResponse } from "next/server";
import { getDbPool } from "@/db";
import { clientPermission } from "@/lib/authorization";
import { getPortalContext } from "@/lib/portal-context";

export const runtime = "nodejs";
export const dynamic = "force-dynamic";

async function loadClientInspection(externalId: string) {
  const portal = await getPortalContext();
  if (!portal) return { session: null, inspection: null, profile: null, db: null, isSupport: false };
  const session = portal.session;

  const db = getDbPool();
  const [inspectionRows] = await db.execute(
    "SELECT id, external_id, vehicle_type, plate, vehicle_description, model_year, status, risk_score, created_at, completed_at FROM inspections WHERE tenant_id = ? AND external_id = ? LIMIT 1",
    [portal.tenantId, externalId],
  );
  const inspection = (inspectionRows as Record<string, unknown>[])[0];
  if (!inspection) return { session, inspection: null, profile: null, db, isSupport: portal.isSupport };

  const [profileRows] = await db.execute(
    "SELECT client_can_view_photos, client_can_manual_review, client_can_download_report FROM tenant_access_profiles WHERE tenant_id = ? LIMIT 1",
    [portal.tenantId],
  );
  const profile = (profileRows as Record<string, unknown>[])[0] ?? {};
  return { session, inspection, profile, db, isSupport: portal.isSupport };
}

export async function GET(_: Request, { params }: { params: Promise<{ externalId: string }> }) {
  try {
    const { externalId } = await params;
    const { session, db, inspection, profile, isSupport } = await loadClientInspection(externalId);
    if (!session) return NextResponse.json({ error: "Faça login no portal do cliente." }, { status: 401 });
    if (!db || !inspection || !profile) return NextResponse.json({ error: "Vistoria não encontrada." }, { status: 404 });

    const canViewPhotos = isSupport || await clientPermission(session, "can_view_photos");
    const canManualReview = isSupport || await clientPermission(session, "can_manual_review");
    const canDownloadReport = isSupport || await clientPermission(session, "can_download_report");
    const inspectionId = String(inspection.id);
    const [photos] = canViewPhotos
      ? await db.execute(
        `SELECT p.id, p.category_code, p.ai_status, p.ai_quality_score, p.created_at,
                a.status AS analysis_status, a.summary AS analysis_summary, a.findings AS analysis_findings,
                a.requires_human AS analysis_requires_human,
                m.assessment AS manual_assessment, m.damage_location AS manual_damage_location,
                m.comments AS manual_comments, m.analyst_name AS manual_analyst_name,
                c.human_comments
         FROM inspection_photos p
         LEFT JOIN inspection_photo_analyses a ON a.inspection_photo_id = p.id
         LEFT JOIN inspection_photo_manual_assessments m ON m.inspection_photo_id = p.id
         LEFT JOIN (
           SELECT inspection_photo_id,
                  GROUP_CONCAT(CONCAT(analyst_name, ': ', comment) ORDER BY updated_at SEPARATOR '\\n') AS human_comments
           FROM inspection_photo_comments
           GROUP BY inspection_photo_id
         ) c ON c.inspection_photo_id = p.id
         WHERE p.inspection_id = ? AND p.inspection_cycle = ?
           AND p.ai_status <> 'retriage' AND COALESCE(a.status, '') <> 'failed'
         ORDER BY p.created_at`,
        [inspectionId, Number(inspection.inspection_cycle || 1)],
      )
      : [[]];
    const [reviewRows] = await db.execute(
      "SELECT analyst_name, review_status, decision, comments, reason, completed_at FROM inspection_reviews WHERE inspection_id = ? AND review_status = 'completed' ORDER BY completed_at DESC LIMIT 1",
      [inspectionId],
    );
    return NextResponse.json({
      inspection,
      photos,
      profile: { ...profile, client_can_view_photos: canViewPhotos, client_can_manual_review: canManualReview, client_can_download_report: canDownloadReport },
      review: (reviewRows as Record<string, unknown>[])[0] ?? null,
    });
  } catch (error: unknown) {
    const code = typeof error === "object" && error && "code" in error ? String(error.code) : "";
    if (code === "ER_NO_SUCH_TABLE") return NextResponse.json({ error: "Perfil de acesso ainda não configurado.", hint: "Execute a migration 005_tenant_access_profiles.sql." }, { status: 503 });
    console.error("Erro ao carregar vistoria para cliente", error);
    return NextResponse.json({ error: "Não foi possível carregar a vistoria." }, { status: 500 });
  }
}

export async function POST(request: Request, { params }: { params: Promise<{ externalId: string }> }) {
  try {
    const { externalId } = await params;
    const body = await request.json();
    const { session, db, inspection, isSupport } = await loadClientInspection(externalId);
    if (!session) return NextResponse.json({ error: "Faça login no portal do cliente." }, { status: 401 });
    if (!db || !inspection) return NextResponse.json({ error: "Vistoria não encontrada." }, { status: 404 });
    if (!isSupport && !await clientPermission(session, "can_manual_review")) return NextResponse.json({ error: "A análise manual não está habilitada para seu perfil." }, { status: 403 });

    const decision = String(body.decision || "");
    const reason = String(body.reason || "").trim();
    const comments = String(body.comments || "").trim();
    if (!['approved', 'approved_with_notes', 'retriage', 'rejected'].includes(decision) || !reason || !comments) return NextResponse.json({ error: "Informe decisão, motivo e comentários." }, { status: 400 });

    const inspectionId = String(inspection.id);
    await db.execute(
      "INSERT INTO inspection_reviews (id, inspection_id, analyst_name, review_status, decision, comments, confirmed_findings, discarded_findings, reason, rules_version, completed_at) VALUES (?, ?, ?, 'completed', ?, ?, JSON_ARRAY(), JSON_ARRAY(), ?, 'Decisão do cliente', NOW())",
      [randomUUID(), inspectionId, session.name, decision, comments, reason],
    );
    await db.execute("UPDATE inspections SET status = ?, completed_at = NOW() WHERE id = ?", [decision, inspectionId]);
    return NextResponse.json({ message: "Decisão do cliente registrada." });
  } catch (error) {
    console.error("Erro ao registrar análise do cliente", error);
    return NextResponse.json({ error: "Não foi possível registrar a análise." }, { status: 500 });
  }
}