/**
 * End impersonation session — POST /api/admin/impersonation/end
 *
 * Requires a current impersonation session (session.impersonation === true).
 * Clears the zync_session cookie and emits admin.impersonation_ended via
 * writeAdminAuditLog.
 *
 * Returns { redirectTo } so the client can redirect back to the admin portal.
 */
import { Hono } from 'hono'
import { deleteCookie } from 'hono/cookie'
import { authMiddleware } from '../middleware/auth'
import { createDb, writeAdminAuditLog, findAdminById } from '@zync/db/queries'
import type { SessionPayload } from '@zync/types'
import type { AppEnv } from '../types'

const COOKIE_OPTS = {
  httpOnly: true,
  secure: true,
  sameSite: 'Strict' as const,
  domain: '.zync.is',
  path: '/',
}

export const impersonationEndRoute = new Hono<AppEnv>()

impersonationEndRoute.use('*', authMiddleware)

// POST /api/admin/impersonation/end
impersonationEndRoute.post('/', async (c) => {
  const session = c.get('session') as SessionPayload | undefined

  if (!session || session.type !== 'user' || session.impersonation !== true) {
    return c.json({ error: 'No active impersonation session' }, 400)
  }

  const adminId = session.impersonating_admin_id
  const tenantId = session.tid
  const tenantSlug = session.tenantSlug ?? ''

  if (!adminId || !tenantId) {
    return c.json({ error: 'Malformed impersonation session' }, 400)
  }

  // Clear the session cookie
  deleteCookie(c, 'zync_session', COOKIE_OPTS)

  // Emit audit event for impersonation_ended
  const db = createDb(c.env)

  // Look up admin email for audit label
  const admin = await findAdminById(db, adminId)

  await writeAdminAuditLog(db, {
    tenantId,
    actorId: adminId,
    entityType: 'tenant',
    entityId: tenantId,
    action: 'admin.impersonation_ended',
    changes: {
      tenant_slug: [tenantSlug, null],
      admin_email: [admin?.email ?? adminId, null],
    },
    ip: c.req.header('cf-connecting-ip') ?? c.req.header('x-forwarded-for') ?? null,
  })

  const redirectTo = tenantSlug
    ? `https://admin.zync.is/tenants/${tenantSlug}`
    : 'https://admin.zync.is/tenants'

  return c.json({ redirectTo })
})