import { NextResponse, type NextRequest } from "next/server";
import { SESSION_COOKIE_NAME, getAuthRuntimeConfig, safeNextPath } from "@/lib/auth/config";
import { hasAdminAccess } from "@/lib/auth/permissions";
import { parseSessionCookieValue, readChunkedCookieValue } from "@/lib/auth/session";

export async function middleware(request: NextRequest) {
  const config = getAuthRuntimeConfig();
  if (!config.required) return NextResponse.next();

  const pathname = request.nextUrl.pathname;
  if (config.configured && config.sessionSecret) {
    const session = await parseSessionCookieValue(
      readChunkedCookieValue(SESSION_COOKIE_NAME, (name) => request.cookies.get(name)?.value),
      config.sessionSecret
    );
    if (session) {
      if (isAdminPath(pathname) && !hasAdminAccess(session.user)) {
        if (pathname.startsWith("/api/")) {
          return NextResponse.json({ error: "需要管理员权限。" }, { status: 403 });
        }
        return NextResponse.redirect(new URL("/create", request.url));
      }
      return NextResponse.next();
    }
  }

  if (pathname.startsWith("/api/")) {
    return NextResponse.json({
      error: config.configured ? "请先登录。" : "认证配置不完整。"
    }, { status: config.configured ? 401 : 503 });
  }

  const loginUrl = new URL("/auth/login", request.url);
  loginUrl.searchParams.set("next", safeNextPath(`${pathname}${request.nextUrl.search}`));
  if (!config.configured) loginUrl.searchParams.set("error", "auth_not_configured");
  return NextResponse.redirect(loginUrl);
}

export const config = {
  matcher: [
    "/",
    "/create/:path*",
    "/assets/:path*",
    "/logs/:path*",
    "/settings/:path*",
    "/accounts/:path*",
    "/image-edit/:path*",
    "/uploads/:path*",
    "/generated-results/:path*",
    "/api/assets/:path*",
    "/api/generations/:path*",
    "/api/logs/:path*",
    "/api/prompt/:path*",
    "/api/settings/:path*",
    "/api/admin/:path*"
  ]
};

function isAdminPath(pathname: string): boolean {
  return pathname.startsWith("/logs") ||
    pathname.startsWith("/settings") ||
    pathname.startsWith("/accounts") ||
    pathname.startsWith("/api/logs") ||
    pathname.startsWith("/api/settings") ||
    pathname.startsWith("/api/admin");
}