const express = require('express');
const router = express.Router();
const { Pool } = require('pg');

// In a real app, you would have an admin middleware protecting this
// const { verifyAdminToken } = require('../middleware/adminAuth');

const pgPool = new Pool({
    host: process.env.PGHOST || 'postgres',
    port: process.env.PGPORT || 5432,
    user: process.env.PGUSER || 'postgres',
    password: process.env.PGPASSWORD || 'postgres',
    database: process.env.PGDATABASE || 'ckqr',
});

// List all users
router.get('/users', async (req, res) => {
    try {
        const result = await pgPool.query('SELECT id, email, role, created_at FROM users ORDER BY created_at DESC');
        res.json(result.rows);
    } catch (err) {
        console.error(err);
        res.status(500).json({ error: 'Server Error' });
    }
});

// Update a user's tier
router.put('/users/:id/tier', async (req, res) => {
    const { id } = req.params;
    const { role } = req.body; // 'free', 'pro', 'enterprise'

    if (!['free', 'pro', 'enterprise'].includes(role)) {
        return res.status(400).json({ error: 'Invalid role specified' });
    }

    try {
        const result = await pgPool.query(
            'UPDATE users SET role = $1 WHERE id = $2 RETURNING id, email, role',
            [role, id]
        );

        if (result.rows.length === 0) {
            return res.status(404).json({ error: 'User not found' });
        }

        res.json({ message: 'User tier updated successfully', user: result.rows[0] });
    } catch (err) {
        console.error(err);
        res.status(500).json({ error: 'Server Error' });
    }
});

// Get all API settings
router.get('/settings', async (req, res) => {
    try {
        const result = await pgPool.query('SELECT * FROM app_settings ORDER BY category, key');
        res.json(result.rows);
    } catch (err) {
        console.error(err);
        res.status(500).json({ error: 'Server Error fetching settings' });
    }
});

// Update multiple API settings
router.put('/settings', async (req, res) => {
    const { settings } = req.body; // Array of { key, value }
    if (!Array.isArray(settings)) return res.status(400).json({ error: 'Invalid settings format' });

    const client = await pgPool.connect();
    try {
        await client.query('BEGIN');
        for (const setting of settings) {
            await client.query(
                `INSERT INTO app_settings (key, value) 
                 VALUES ($1, $2) 
                 ON CONFLICT (key) DO UPDATE SET value = $2, updated_at = CURRENT_TIMESTAMP`,
                [setting.key, setting.value]
            );
        }
        await client.query('COMMIT');
        res.json({ message: 'Settings updated successfully' });
    } catch (err) {
        await client.query('ROLLBACK');
        console.error(err);
        res.status(500).json({ error: 'Server Error updating settings' });
    } finally {
        client.release();
    }
});

module.exports = router;