/**
 * POST /api/admin/tenants/provision — admin-tenant-provisioning.
 *
 * Creates a fully verified tenant + owner user in one shot, bypassing the
 * email-verification flow. Intended for admin-initiated demo / enterprise
 * tenant provisioning. Requires an active admin session.
 *
 * Body: { tenantName, ownerEmail, ownerPassword, ownerName? }
 * Returns: { tenantId, tenantSlug, userId }
 */
import { Hono } from 'hono'
import { z } from 'zod'
import { hashPassword } from '@zync/auth'
import {
  completeEmailVerification,
  createDb,
  createFreelancerSubscription,
  createPendingUser,
  findUserByEmail,
} from '@zync/db/queries'
import type { AppEnv } from '../../types'
import { withDoHash } from '../../lib/password-hash-do'
import { adminAuthMiddleware } from '../../middleware/admin-auth'
import { requireAdminSession } from '../../middleware/guards'
import { requireAdminPermission } from '@zync/auth'

const provisionSchema = z.object({
  tenantName: z.string().min(2).max(80),
  ownerEmail: z.string().email(),
  ownerPassword: z.string().min(8),
  ownerName: z.string().min(1).max(100).optional(),
})

export const adminProvisionTenantRoute = new Hono<AppEnv>()

adminProvisionTenantRoute.use('*', adminAuthMiddleware)
adminProvisionTenantRoute.use('*', requireAdminSession())
adminProvisionTenantRoute.use('*', requireAdminPermission('admin.tenants:write'))

adminProvisionTenantRoute.post('/provision', async (c) => {
  const parsed = provisionSchema.safeParse(await c.req.json())
  if (!parsed.success) return c.json({ error: 'Invalid request', issues: parsed.error.flatten() }, 400)

  const { tenantName, ownerEmail, ownerPassword, ownerName } = parsed.data
  const db = createDb(c.env)

  const existing = await findUserByEmail(db, ownerEmail)
  if (existing) return c.json({ error: 'Email already registered' }, 409)

  const passwordHash = await hashPassword(ownerPassword, withDoHash(c.env))
  const { id: userId } = await createPendingUser(db, {
    email: ownerEmail,
    passwordHash,
    name: ownerName ?? null,
    emailVerified: true,
  })

  const result = await completeEmailVerification(db, {
    userId,
    tenantName,
    actorIp: c.req.header('CF-Connecting-IP') ?? null,
    requestId: c.req.header('CF-Ray') ?? null,
  })

  await createFreelancerSubscription(db, result.tenantId)

  return c.json({ tenantId: result.tenantId, tenantSlug: result.tenantSlug, userId }, 201)
})