import { createDbService } from '@/server/services/db.js';
import type { MiddlewareHandler } from 'astro';
import { and, eq } from 'drizzle-orm';
import { env } from '@/server/env.js';

const SHARE_SLUG_RE = /^[A-Za-z0-9]{8}$/;
const MAX_AGE = 30 * 86_400; // 30 days

async function isActiveShareSlug(slug: string): Promise<boolean> {
  if (!env.DATABASE_URL) return false;

  const { shareLinks } = await import('@/server/db/schema.js');
  const db = createDbService({ DATABASE_URL: env.DATABASE_URL });
  const [row] = await db
    .select({ id: shareLinks.id })
    .from(shareLinks)
    .where(and(eq(shareLinks.slug, slug), eq(shareLinks.isActive, true)))
    .limit(1);

  return row !== undefined;
}

export const shareAttributionMiddleware: MiddlewareHandler = async (ctx, next) => {
  const response = await next();

  // Only instrument GET page loads.
  if (ctx.request.method !== 'GET') return response;

  const url = new URL(ctx.request.url);
  const utmContent = url.searchParams.get('utm_content');
  if (!utmContent || !SHARE_SLUG_RE.test(utmContent)) return response;

  // First-touch NX: don't overwrite an existing attribution cookie.
  const cookieHeader = ctx.request.headers.get('cookie') ?? '';
  const hasShareCookie = cookieHeader.split(';').some((c) => c.trim().startsWith('__sh='));
  if (hasShareCookie) return response;

  if (!(await isActiveShareSlug(utmContent))) return response;

  const clone = new Response(response.body, response);
  clone.headers.append(
    'Set-Cookie',
    `__sh=${utmContent}; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=${MAX_AGE}`,
  );
  return clone;
};