/**
 * Payment gateway settings routes — payment-gateway-adapters (wave-10 leaf 5).
 * Mounted at /api/settings/payment-gateway.
 *
 * GET  / → { gateway, isActive, testMode, configured } (masked — no secrets)
 * PATCH / → update gateway config (encrypt credentials)
 *
 * Guarded by authMiddleware + settings:write permission on PATCH.
 * PATCH writes an audit log row in the same transaction (via query helper).
 */
import { Hono } from 'hono'
import type { AppEnv } from '../../types'
import { authMiddleware } from '../../middleware/auth'
import { blockDuringImpersonation } from '../../middleware/block-impersonation-ops'
import { requirePermission } from '../../middleware/guards'
import {
  createDb,
  getPaymentGatewayConfigMasked,
  upsertPaymentGatewayConfig,
  upsertPaymentGatewaySchema,
  logAuditEvent,
} from '@zync/db/queries'

// ── Router ─────────────────────────────────────────────────────────────────────

export const paymentGatewaySettingsRoute = new Hono<AppEnv>()

paymentGatewaySettingsRoute.use('*', authMiddleware)

// GET /api/settings/payment-gateway
paymentGatewaySettingsRoute.get('/', async (c) => {
  const session = c.get('session')
  if (!session || session.type !== 'user' || !session.tid) {
    return c.json({ error: 'Unauthorized' }, 401)
  }

  const db = c.get('db') ?? createDb(c.env)
  const config = await getPaymentGatewayConfigMasked(db, session.tid)

  if (!config) {
    return c.json(
      { configured: false, gateway: null, isActive: false, testMode: true },
      200,
    )
  }

  return c.json(config, 200)
})

// PATCH /api/settings/payment-gateway
paymentGatewaySettingsRoute.patch(
  '/',
  blockDuringImpersonation(),
  requirePermission('settings:write'),
  async (c) => {
    const session = c.get('session')
    if (!session || session.type !== 'user' || !session.tid) {
      return c.json({ error: 'Unauthorized' }, 401)
    }

    const body = await c.req.json().catch(() => null)
    const parsed = upsertPaymentGatewaySchema.safeParse(body)
    if (!parsed.success) {
      return c.json({ error: 'Validation failed', issues: parsed.error.issues }, 400)
    }

    const db = c.get('db') ?? createDb(c.env)
    await upsertPaymentGatewayConfig(db, session.tid, session.sub, parsed.data)

    await logAuditEvent(c, {
      tenantId: session.tid,
      userId: session.sub,
      entityType: 'payment_gateway_config',
      entityId: session.tid,
      eventType: 'settings.updated',
      metadata: { field: 'payment_gateway', new_value: parsed.data.gateway },
    })

    const updated = await getPaymentGatewayConfigMasked(db, session.tid)
    return c.json(
      updated ?? { configured: false, gateway: null, isActive: false, testMode: true },
      200,
    )
  },
)