/**
 * Email template routes — email-template-editor (wave-11 leaf-E).
 * Mounted at /api/email-templates.
 *
 * GET    /                → EmailTemplateListItem[] (settings:read)
 * GET    /:key            → EmailTemplateDetail (settings:read)
 * PUT    /:key            → EmailTemplateDetail (settings:write)
 * DELETE /:key            → 204 reset (settings:write)
 * POST   /:key/preview    → PreviewEmailTemplateResponse (settings:read)
 */
import { Hono } from 'hono'
import { z } from 'zod'
import type { AppEnv } from '../types'
import { authMiddleware } from '../middleware/auth'
import { requirePermission } from '../middleware/guards'
import {
  getTenantEmailTemplate,
  listTenantEmailTemplates,
  saveTenantEmailTemplate,
  resetTenantEmailTemplate,
} from '@zync/db/queries'
import { EMAIL_TEMPLATE_KEYS } from '@zync/types'

const EMAIL_TEMPLATE_VARIABLES: Record<string, string[]> = {
  invoice_sent: ['invoiceNumber', 'tenantName', 'customerName', 'amount', 'dueDate', 'invoiceUrl'],
  invoice_reminder: ['invoiceNumber', 'tenantName', 'customerName', 'amount', 'dueDate', 'invoiceUrl'],
  invoice_paid_receipt: ['invoiceNumber', 'tenantName', 'customerName', 'amount', 'paidDate'],
  proposal_sent: ['tenantName', 'customerName', 'proposalTitle', 'proposalUrl', 'expiryDate'],
  contract_signing_request: ['tenantName', 'signerName', 'contractTitle', 'signingUrl'],
  portal_invitation: ['tenantName', 'contactName', 'portalUrl'],
  lead_form_thank_you: ['tenantName', 'leadName', 'formName'],
}

// ── Validation schemas ─────────────────────────────────────────────────────────

const saveTemplateSchema = z.object({
  subject: z
    .string()
    .trim()
    .min(1)
    .max(300)
    .refine((s) => !s.toLowerCase().includes('<script'), {
      message: 'Subject must not contain script tags',
    }),
  bodyHtml: z
    .string()
    .min(1)
    .max(50_000)
    .refine((s) => !s.toLowerCase().includes('<script'), {
      message: 'Body must not contain script tags',
    }),
})

const templateKeySchema = z.enum(EMAIL_TEMPLATE_KEYS)

export const emailTemplateRoutes = new Hono<AppEnv>()

emailTemplateRoutes.use('*', authMiddleware)

// ── GET /api/email-templates ───────────────────────────────────────────────────

emailTemplateRoutes.get('/', requirePermission('settings:read'), async (c) => {
  const session = c.get('session')
  if (!session || session.type !== 'user' || !session.tid) {
    return c.json({ error: 'Unauthorized' }, 401)
  }

  const db = c.get('db')
  const list = await listTenantEmailTemplates(db, session.tid)
  return c.json(list, 200)
})

// ── GET /api/email-templates/:key ─────────────────────────────────────────────

emailTemplateRoutes.get('/:key', requirePermission('settings:read'), async (c) => {
  const session = c.get('session')
  if (!session || session.type !== 'user' || !session.tid) {
    return c.json({ error: 'Unauthorized' }, 401)
  }

  const keyResult = templateKeySchema.safeParse(c.req.param('key'))
  if (!keyResult.success) {
    return c.json({ error: 'Unknown template key' }, 404)
  }

  const db = c.get('db')
  const tpl = await getTenantEmailTemplate(db, session.tid, keyResult.data)
  return c.json({
    key: keyResult.data,
    subject: tpl.subject,
    bodyHtml: tpl.bodyHtml,
    variables: EMAIL_TEMPLATE_VARIABLES[keyResult.data] ?? [],
    isCustom: tpl.isCustom,
  }, 200)
})

// ── PUT /api/email-templates/:key ─────────────────────────────────────────────

emailTemplateRoutes.put('/:key', requirePermission('settings:write'), async (c) => {
  const session = c.get('session')
  if (!session || session.type !== 'user' || !session.tid) {
    return c.json({ error: 'Unauthorized' }, 401)
  }

  const keyResult = templateKeySchema.safeParse(c.req.param('key'))
  if (!keyResult.success) {
    return c.json({ error: 'Unknown template key' }, 404)
  }

  const body = await c.req.json().catch(() => null)
  const parsed = saveTemplateSchema.safeParse(body)
  if (!parsed.success) {
    return c.json({ error: 'Validation failed', issues: parsed.error.issues }, 422)
  }

  const db = c.get('db')
  // Build plain-text fallback by stripping HTML tags
  const bodyText = parsed.data.bodyHtml.replace(/<[^>]*>/g, ' ').replace(/\s+/g, ' ').trim()
  const saved = await saveTenantEmailTemplate(
    db,
    session.tid,
    keyResult.data,
    parsed.data.subject,
    parsed.data.bodyHtml,
    bodyText,
  )

  return c.json({
    key: keyResult.data,
    subject: saved.subject,
    bodyHtml: saved.bodyHtml,
    variables: EMAIL_TEMPLATE_VARIABLES[keyResult.data] ?? [],
    isCustom: true,
    updatedAt: saved.updatedAt.toISOString(),
  }, 200)
})

// ── DELETE /api/email-templates/:key (reset to default) ───────────────────────

emailTemplateRoutes.delete('/:key', requirePermission('settings:write'), async (c) => {
  const session = c.get('session')
  if (!session || session.type !== 'user' || !session.tid) {
    return c.json({ error: 'Unauthorized' }, 401)
  }

  const keyResult = templateKeySchema.safeParse(c.req.param('key'))
  if (!keyResult.success) {
    return c.json({ error: 'Unknown template key' }, 404)
  }

  const db = c.get('db')
  await resetTenantEmailTemplate(db, session.tid, keyResult.data)
  return c.body(null, 204)
})

// ── POST /api/email-templates/:key/preview ────────────────────────────────────

emailTemplateRoutes.post('/:key/preview', requirePermission('settings:read'), async (c) => {
  const session = c.get('session')
  if (!session || session.type !== 'user' || !session.tid) {
    return c.json({ error: 'Unauthorized' }, 401)
  }

  const keyResult = templateKeySchema.safeParse(c.req.param('key'))
  if (!keyResult.success) {
    return c.json({ error: 'Unknown template key' }, 404)
  }

  const body = await c.req.json().catch(() => null)
  const parsed = saveTemplateSchema.safeParse(body)
  if (!parsed.success) {
    return c.json({ error: 'Validation failed', issues: parsed.error.issues }, 422)
  }

  // Simple variable substitution with sample values for preview
  const sampleVars: Record<string, string> = {
    invoiceNumber: 'INV-0001',
    tenantName: 'Acme Ltd.',
    customerName: 'Example Customer',
    amount: '1,500 ₪',
    dueDate: '2026-07-01',
    invoiceUrl: 'https://portal.example.com/invoice/1',
    paidDate: '2026-06-20',
    proposalTitle: 'Web Development Proposal',
    proposalUrl: 'https://portal.example.com/proposal/1',
    expiryDate: '2026-07-15',
    contractTitle: 'Service Agreement',
    signerName: 'Jane Doe',
    signingUrl: 'https://portal.example.com/sign/1',
    contactName: 'John Smith',
    portalUrl: 'https://portal.example.com',
    leadName: 'Alice',
    formName: 'Contact Form',
    body: 'Sample email body content.',
  }

  const renderedHtml = parsed.data.bodyHtml.replace(
    /\{\{(\w+)\}\}/g,
    (_, key: string) => sampleVars[key] ?? `{{${key}}}`,
  )
  const renderedSubject = parsed.data.subject.replace(
    /\{\{(\w+)\}\}/g,
    (_, key: string) => sampleVars[key] ?? `{{${key}}}`,
  )

  return c.json({ renderedHtml, renderedSubject }, 200)
})