import { eq } from "drizzle-orm";
import { db } from "@/lib/db/client";
import { ldapConfig } from "@/lib/db/schema";
import { encryptCredential, decryptCredential } from "@/lib/crypto/credentials";

export interface LdapSettings {
  host: string;
  port: number;
  useTls: boolean;
  bindDn: string;
  bindPassword: string;
  baseDn: string;
  userFilter: string;
  listFilter: string;
  defaultRole: "admin" | "agent";
}

/** Settings for actually connecting — null if never configured or disabled. */
export async function getLdapSettings(): Promise<LdapSettings | null> {
  const config = await db.query.ldapConfig.findFirst();
  if (!config || !config.enabled) return null;

  return {
    host: config.host,
    port: config.port,
    useTls: config.useTls,
    bindDn: config.bindDn,
    bindPassword: decryptCredential(config.bindPasswordEnc),
    baseDn: config.baseDn,
    userFilter: config.userFilter,
    listFilter: config.listFilter,
    defaultRole: config.defaultRole,
  };
}

export async function saveLdapSettings(settings: LdapSettings): Promise<void> {
  const row = {
    host: settings.host,
    port: settings.port,
    useTls: settings.useTls,
    bindDn: settings.bindDn,
    bindPasswordEnc: encryptCredential(settings.bindPassword),
    baseDn: settings.baseDn,
    userFilter: settings.userFilter,
    listFilter: settings.listFilter,
    defaultRole: settings.defaultRole,
    enabled: true,
    verifiedAt: new Date(),
  };

  const existing = await db.query.ldapConfig.findFirst();
  if (existing) {
    await db.update(ldapConfig).set(row).where(eq(ldapConfig.id, existing.id));
  } else {
    await db.insert(ldapConfig).values(row);
  }
}

export async function disableLdap(): Promise<void> {
  const existing = await db.query.ldapConfig.findFirst();
  if (existing) {
    await db.update(ldapConfig).set({ enabled: false }).where(eq(ldapConfig.id, existing.id));
  }
}

export async function getLdapStatus() {
  const config = await db.query.ldapConfig.findFirst();
  return {
    configured: Boolean(config),
    enabled: Boolean(config?.enabled),
    host: config?.host ?? null,
    port: config?.port ?? null,
    useTls: config?.useTls ?? false,
    bindDn: config?.bindDn ?? null,
    baseDn: config?.baseDn ?? null,
    userFilter: config?.userFilter ?? null,
    listFilter: config?.listFilter ?? null,
    defaultRole: config?.defaultRole ?? "agent",
    verifiedAt: config?.verifiedAt?.getTime() ?? null,
  };
}