import { create } from 'zustand';
import { AdminUser } from '@/types';
import axios from 'axios';

const API_URL = process.env.NEXT_PUBLIC_API_URL || 'http://localhost:4000';

function mapIamRole(roles: { key?: string }[]): 'ADMIN' | 'AGENT' | 'SUPERVISOR' {
  const keys = roles.map((r) => r.key ?? '');
  if (keys.some((k) => k.includes('admin') || k === 'super_admin' || k === 'organization_admin')) return 'ADMIN';
  if (keys.some((k) => k.includes('agent'))) return 'AGENT';
  return 'SUPERVISOR';
}

interface AuthState {
  user: AdminUser | null;
  token: string | null;
  refreshToken: string | null;
  isAuthenticated: boolean;
  login: (email: string, password: string) => Promise<void>;
  logout: () => void;
  setUser: (user: AdminUser, token: string) => void;
  initialize: () => void;
}

export const useAuthStore = create<AuthState>((set) => ({
  user: null,
  token: null,
  refreshToken: null,
  isAuthenticated: false,

  initialize: () => {
    if (typeof window === 'undefined') return;
    const token = localStorage.getItem('auth_token');
    const userStr = localStorage.getItem('auth_user');
    if (token && userStr) {
      try {
        const user = JSON.parse(userStr);
        set({ user, token, isAuthenticated: true });
      } catch {
        localStorage.removeItem('auth_token');
        localStorage.removeItem('auth_refresh_token');
        localStorage.removeItem('auth_user');
      }
    }
  },

  login: async (email: string, password: string) => {
    // Step 1: IAM login — returns token + refreshToken only
    const loginRes = await axios.post(`${API_URL}/v1/auth/login`, { email, password });
    const loginData = loginRes.data?.data ?? loginRes.data;
    const { token, refreshToken } = loginData;
    if (!token) throw new Error('No token received from server');

    // Step 2: fetch full user info with the token
    const meRes = await axios.get(`${API_URL}/v1/auth/me`, {
      headers: { Authorization: `Bearer ${token}` },
    });
    const iamUser = meRes.data?.data ?? meRes.data;

    const user: AdminUser = {
      id: iamUser.id,
      email: iamUser.email,
      fullName: iamUser.name?.en ?? iamUser.name?.am ?? iamUser.email,
      role: mapIamRole(iamUser.roles ?? []),
      active: true,
    };

    localStorage.setItem('auth_token', token);
    localStorage.setItem('auth_user', JSON.stringify(user));
    if (refreshToken) localStorage.setItem('auth_refresh_token', refreshToken);

    set({ user, token, refreshToken: refreshToken ?? null, isAuthenticated: true });
  },

  logout: () => {
    localStorage.removeItem('auth_token');
    localStorage.removeItem('auth_refresh_token');
    localStorage.removeItem('auth_user');
    set({ user: null, token: null, refreshToken: null, isAuthenticated: false });
  },

  setUser: (user: AdminUser, token: string) => {
    set({ user, token, isAuthenticated: true });
  },
}));