/**
 * Integration hub aggregator route — integration-hub (wave-11 leaf-D).
 * Mounted at /api/settings/integrations in routes/index.ts.
 *
 * GET / — returns IntegrationListItem[] for the authenticated tenant.
 *         Admin/owner: all entries. Non-admin member: admin_only entries filtered.
 *
 * This route is GET-only; mutation endpoints are owned by per-integration specs.
 */
import { Hono } from 'hono'
import { createDb } from '@zync/db/queries'
import type { AppEnv } from '../../types'
import { authMiddleware } from '../../middleware/auth'
import { requirePermission } from '../../middleware/guards'
import type { IntegrationListItem, IntegrationStatus } from '@zync/types'
import { INTEGRATION_CATALOG } from '../../features/settings/integrations/catalog'
import { deriveIntegrationStatuses } from '../../services/integrations/status'
import { isOwnerOrAdminRole } from '../../lib/system-roles'

export const integrationsHubRoute = new Hono<AppEnv>()

integrationsHubRoute.use('*', authMiddleware)

integrationsHubRoute.get(
  '/',
  requirePermission('settings:read'),
  async (c) => {
    const session = c.get('session')
    if (!session || session.type !== 'user' || !session.tid) {
      return c.json({ error: 'Unauthorized' }, 401)
    }

    const tenantId = session.tid
    const role = (session as { role?: string }).role ?? ''

    const db = createDb(c.env)
    const derivedStatuses = await deriveIntegrationStatuses(db, tenantId)

    const isAdmin = isOwnerOrAdminRole(role)

    const items: IntegrationListItem[] = []
    for (const entry of INTEGRATION_CATALOG) {
      // Security: hide admin_only entries from non-admin members
      if (entry.admin_only && !isAdmin) continue

      const derived = entry.status_source
        ? derivedStatuses.get(entry.status_source)
        : undefined

      const status: IntegrationStatus = derived?.status ?? 'not_connected'
      const details = derived?.details ?? {}

      items.push({
        id: entry.id,
        name: entry.name,
        category: entry.category,
        description: entry.description,
        tier_required: entry.tier_required,
        manage_url: entry.manage_url,
        connect_kind: entry.connect_kind,
        admin_only: entry.admin_only,
        status,
        details,
      })
    }

    return c.json(items, 200)
  },
)