'use server'

import { createClient } from '@/lib/supabase/server'
import { createAdminClient } from '@/lib/supabase/admin'
import { headers } from 'next/headers'

export async function signIn(email: string, password: string) {
  try {
    const supabase = await createClient()
    const { data, error } = await supabase.auth.signInWithPassword({
      email,
      password,
    })
    if (error) {
      return { success: false, error: error.message }
    }

    const userId = data.user?.id
    if (userId) {
      let { data: userData, error: userError } = await supabase
        .from('users')
        .select('role')
        .eq('id', userId)
        .single()

      if (userError || !userData) {
        // Fallback: create database records if missing for this authenticated user
        try {
          const adminSupabase = createAdminClient()
          
          // Ensure profile exists
          await adminSupabase.from('profiles').insert([{ id: userId }]).select()
          
          // Ensure user exists
          const { data: insertedUser, error: insertError } = await adminSupabase
            .from('users')
            .insert([{ id: userId, role: 'partner' }])
            .select('role')
            .single()

          if (!insertError && insertedUser) {
            userData = insertedUser
            userError = null
          }
        } catch (adminErr) {
          console.error("Failed to backfill user records:", adminErr)
        }
      }

      if (userError || !userData || (userData.role !== 'partner' && userData.role !== 'admin')) {
        await supabase.auth.signOut()
        if (userData?.role === 'gesperrt') {
          return { success: false, error: "Ihr Konto wurde gesperrt. Bitte wenden Sie sich an den Administrator." }
        }
        return { success: false, error: "Zugriff verweigert. Nur registrierte Partner dürfen sich anmelden." }
      }

      // Andere aktive Sitzungen beenden
      await supabase.auth.signOut({ scope: 'others' })

      return { success: true, role: userData.role }
    }

    return { success: true, role: 'partner' }
  } catch (err: any) {
    console.error("SignIn error:", err)
    return { success: false, error: err?.message || "Ein unerwarteter Fehler ist aufgetreten." }
  }
}

export async function signUp(email: string, password: string) {
  throw new Error("Registrierung ist deaktiviert.")
}

export async function signOut() {
  const supabase = await createClient()
  const { error } = await supabase.auth.signOut()
  if (error) {
    throw new Error(error.message)
  }
  return { success: true }
}

export async function resetPassword(email: string) {
  const supabase = await createClient()
  const origin = (await headers()).get('origin') || ''
  const { error } = await supabase.auth.resetPasswordForEmail(email, {
    redirectTo: `${origin}/auth/update-password`,
  })
  if (error) {
    throw new Error(error.message)
  }
  return { success: true }
}

export async function updatePassword(password: string) {
  const supabase = await createClient()
  const { error } = await supabase.auth.updateUser({ password })
  if (error) {
    throw new Error(error.message)
  }
  return { success: true }
}

export async function verifyAdmin() {
  const supabase = await createClient()
  const { data: { user } } = await supabase.auth.getUser()
  if (!user) throw new Error("Nicht authentifiziert.")

  const { data: userData, error } = await supabase
    .from('users')
    .select('role')
    .eq('id', user.id)
    .single()

  if (error || !userData || userData.role !== 'admin') {
    throw new Error("Zugriff verweigert. Nur Administratoren erlaubt.")
  }
  return user
}
