#!/usr/bin/env node
/** Staff access plane (CS / sales / accounting). Not Zapier, not customer API. */
import fs from 'node:fs';
import http from 'node:http';
import path from 'node:path';
import { fileURLToPath } from 'node:url';
import { listCustomers, withCustomerName } from './names.js';

const PUBLIC = path.join(path.dirname(fileURLToPath(import.meta.url)), '..', 'public');
const PORT = Number(process.env.PORT || 3025);
const AUTHZ = (process.env.AUTHZ_URL || 'http://127.0.0.1:3020').replace(/\/$/, '');
const BOOKS = (process.env.ACCOUNT_BALANCE_URL || 'http://127.0.0.1:3010').replace(/\/$/, '');
const EDGE = (process.env.ZAPPIER_ADMIN_URL || 'http://127.0.0.1:3000').replace(/\/$/, '');
const KEY = process.env.ZAPPIER_ADMIN_KEY || 'admin-dev-key';
const PLANE = 'staff';

async function check(subject, extra = {}) {
  const r = await fetch(`${AUTHZ}/check`, {
    method: 'POST',
    headers: { 'content-type': 'application/json' },
    body: JSON.stringify({ plane: PLANE, subject, ...extra }),
  });
  return r.json();
}

const server = http.createServer(async (req, res) => {
  const url = new URL(req.url || '/', `http://127.0.0.1:${PORT}`);
  const json = (code, obj) => {
    res.writeHead(code, { 'content-type': 'application/json' });
    res.end(JSON.stringify(obj));
  };
  try {
    if (req.method === 'GET' && (url.pathname === '/' || url.pathname === '/index.html')) {
      if (process.env.STAFF_AUTH === '1') {
        const login = (process.env.STAFF_SESSION_URL || 'http://127.0.0.1:3027').replace(/\/$/, '');
        const chk = await fetch(`${login}/check`, { headers: { cookie: req.headers.cookie || '' } }).catch(() => null);
        if (!chk || !chk.ok) {
          res.writeHead(302, { location: `${login}/login?next=${encodeURIComponent('http://' + (req.headers.host || '127.0.0.1') + '/')}` });
          res.end();
          return;
        }
      }
      res.writeHead(200, { 'content-type': 'text/html; charset=utf-8' });
      res.end(fs.readFileSync(path.join(PUBLIC, 'index.html')));
      return;
    }
    if (req.method === 'GET' && url.pathname === '/health') {
      return json(200, { ok: true, role: 'verae-access-staff', plane: PLANE });
    }
    if (req.method === 'GET' && url.pathname === '/customers') {
      return json(200, { customers: await listCustomers(EDGE, KEY) });
    }
    const review = url.pathname.match(/^\/review\/([^/]+)$/);
    if (req.method === 'GET' && review) {
      const id = decodeURIComponent(review[1]);
      const gate = await check('verae.billing.statement.get', { principal: id });
      if (!gate.allow) return json(403, gate);
      const r = await fetch(`${BOOKS}/statement/${encodeURIComponent(id)}`);
      const body = await withCustomerName({ ...(await r.json()), plane: PLANE, source: 'account-balance' }, id, EDGE, KEY);
      return json(r.status, body);
    }
    if (req.method === 'POST' && url.pathname === '/credits') {
      const chunks = [];
      for await (const c of req) chunks.push(c);
      const body = JSON.parse(Buffer.concat(chunks).toString('utf8') || '{}');
      const gate = await check('verae.billing.balance.adjust', { kind: 'credit', principal: body.agent });
      if (!gate.allow) return json(403, gate);
      const r = await fetch(`${BOOKS}/adjust`, {
        method: 'POST',
        headers: { 'content-type': 'application/json' },
        body: JSON.stringify({ ...body, kind: 'credit' }),
      });
      return json(r.status, { ...(await r.json()), plane: PLANE });
    }
    json(404, { error: 'not found' });
  } catch (err) {
    json(502, { error: err.message });
  }
});

server.listen(PORT, '0.0.0.0', () => {
  process.stdout.write(`verae-access-staff http://0.0.0.0:${PORT}/ plane=${PLANE}\n`);
});