import { randomUUID } from "node:crypto";
import express, { type Express, type Request, type Response } from "express";
import { z } from "zod";
import { authenticatedUser } from "./auth.js";
import { supabaseAdmin } from "./supabase.js";

const BUCKET = "profile-images";
const MAX_BYTES = 4 * 1024 * 1024;
const uploadBody = express.raw({ type: ["image/jpeg", "image/png", "image/webp"], limit: MAX_BYTES });
const playerIdSchema = z.string().uuid();

type Owner = "players" | "users";
type ImageType = { mime: string; extension: string };

async function canAccessPlayer(userId: string, playerId: string) {
  const { data: user, error: userError } = await supabaseAdmin.from("users").select("account_role").eq("user_id", userId).maybeSingle();
  if (userError) throw new Error(`Unable to verify account permissions: ${userError.message}`);
  if (String(user?.account_role ?? "user").toLowerCase() === "admin") return true;
  const { data: player, error } = await supabaseAdmin.from("players").select("player_id").eq("player_id", playerId).eq("user_id", userId).maybeSingle();
  if (error) throw new Error(`Unable to verify player ownership: ${error.message}`);
  return Boolean(player);
}

function inspectImage(bytes: Buffer): ImageType | null {
  if (bytes.length < 12 || bytes.length > MAX_BYTES) return null;
  if (bytes[0] === 0xff && bytes[1] === 0xd8 && bytes[2] === 0xff) return { mime: "image/jpeg", extension: "jpg" };
  if (bytes.subarray(0, 8).equals(Buffer.from([137, 80, 78, 71, 13, 10, 26, 10]))) return { mime: "image/png", extension: "png" };
  if (bytes.toString("ascii", 0, 4) === "RIFF" && bytes.toString("ascii", 8, 12) === "WEBP") return { mime: "image/webp", extension: "webp" };
  return null;
}

function safePreviousPath(owner: Owner, id: string, path: string | null | undefined) {
  const prefix = `${owner}/${id}/`;
  if (!path?.startsWith(prefix)) return null;
  const filename = path.slice(prefix.length);
  return /^[0-9a-f-]{36}\.(jpg|png|webp)$/.test(filename) ? path : null;
}

async function removeStoredImage(path: string) {
  const { error } = await supabaseAdmin.storage.from(BUCKET).remove([path]);
  if (error) throw new Error(`Unable to remove profile image: ${error.message}`);
}

async function sendImage(res: Response, path: string | null | undefined) {
  if (!path) return res.status(404).json({ error: "Profile image not found." });
  const { data, error } = await supabaseAdmin.storage.from(BUCKET).download(path);
  if (error || !data) return res.status(404).json({ error: "Profile image not found." });
  const type = path.endsWith(".png") ? "image/png" : path.endsWith(".webp") ? "image/webp" : "image/jpeg";
  res.set({
    "Content-Type": type,
    // Each upload gets a new UUID path, so this response never needs revalidation.
    "Cache-Control": "private, max-age=31536000, immutable",
    "Cross-Origin-Resource-Policy": "cross-origin",
    "X-Content-Type-Options": "nosniff",
  });
  return res.send(Buffer.from(await data.arrayBuffer()));
}

async function uploadImage(req: Request, res: Response, owner: Owner, id: string, previousPath: string | null | undefined) {
  const bytes = req.body;
  if (!Buffer.isBuffer(bytes)) return res.status(415).json({ error: "Choose a JPG, PNG or WEBP image." });
  const type = inspectImage(bytes);
  if (!type || req.headers["content-type"]?.split(";")[0] !== type.mime) {
    return res.status(415).json({ error: "Choose a valid JPG, PNG or WEBP image up to 4 MB." });
  }
  const path = `${owner}/${id}/${randomUUID()}.${type.extension}`;
  const { error: uploadError } = await supabaseAdmin.storage.from(BUCKET).upload(path, bytes, {
    contentType: type.mime,
    cacheControl: "31536000",
    upsert: false,
  });
  if (uploadError) throw new Error(`Unable to upload profile image: ${uploadError.message}`);

  const table = owner === "players" ? "players" : "users";
  const idColumn = owner === "players" ? "player_id" : "user_id";
  const { data: saved, error: saveError } = await supabaseAdmin.from(table).update({ image_path: path }).eq(idColumn, id).select(idColumn).maybeSingle();
  if (saveError || !saved) {
    await removeStoredImage(path).catch((cleanupError) => console.error(cleanupError));
    throw new Error(`Unable to save profile image: ${saveError?.message ?? "Profile not found."}`);
  }
  const oldPath = safePreviousPath(owner, id, previousPath);
  if (oldPath) await removeStoredImage(oldPath).catch((cleanupError) => console.error(cleanupError));
  return res.json({ imagePath: path });
}

async function deleteImage(res: Response, owner: Owner, id: string, previousPath: string | null | undefined) {
  const table = owner === "players" ? "players" : "users";
  const idColumn = owner === "players" ? "player_id" : "user_id";
  const { data: saved, error } = await supabaseAdmin.from(table).update({ image_path: null }).eq(idColumn, id).select(idColumn).maybeSingle();
  if (error || !saved) throw new Error(`Unable to remove profile image: ${error?.message ?? "Profile not found."}`);
  const oldPath = safePreviousPath(owner, id, previousPath);
  if (oldPath) await removeStoredImage(oldPath).catch((cleanupError) => console.error(cleanupError));
  return res.json({ imagePath: null });
}

export function registerProfileImageRoutes(app: Express) {
  app.get("/api/auth/image", async (req, res, next) => {
    try {
      const current = await authenticatedUser(req, res);
      if (!current) return res.status(401).json({ error: "Authentication required." });
      const { data, error } = await supabaseAdmin.from("users").select("image_path").eq("user_id", current.user.id).maybeSingle();
      if (error) throw new Error(`Unable to load user image: ${error.message}`);
      return await sendImage(res, safePreviousPath("users", current.user.id, data?.image_path));
    } catch (error) { next(error); }
  });

  app.post("/api/auth/image", uploadBody, async (req, res, next) => {
    try {
      const current = await authenticatedUser(req, res);
      if (!current) return res.status(401).json({ error: "Authentication required." });
      const { data, error } = await supabaseAdmin.from("users").select("image_path").eq("user_id", current.user.id).maybeSingle();
      if (error || !data) return res.status(404).json({ error: "User profile not found." });
      return await uploadImage(req, res, "users", current.user.id, data.image_path);
    } catch (error) { next(error); }
  });

  app.delete("/api/auth/image", async (req, res, next) => {
    try {
      const current = await authenticatedUser(req, res);
      if (!current) return res.status(401).json({ error: "Authentication required." });
      const { data, error } = await supabaseAdmin.from("users").select("image_path").eq("user_id", current.user.id).maybeSingle();
      if (error || !data) return res.status(404).json({ error: "User profile not found." });
      return await deleteImage(res, "users", current.user.id, data.image_path);
    } catch (error) { next(error); }
  });

  app.get("/api/players/:playerId/image", async (req, res, next) => {
    try {
      const current = await authenticatedUser(req, res);
      if (!current) return res.status(401).json({ error: "Authentication required." });
      const id = playerIdSchema.safeParse(req.params.playerId);
      if (!id.success) return res.status(404).json({ error: "Player not found." });
      if (!await canAccessPlayer(current.user.id, id.data)) return res.status(404).json({ error: "Player not found." });
      const { data, error } = await supabaseAdmin.from("players").select("image_path").eq("player_id", id.data).maybeSingle();
      if (error) throw new Error(`Unable to load player image: ${error.message}`);
      if (!data) return res.status(404).json({ error: "Player not found." });
      return await sendImage(res, safePreviousPath("players", id.data, data?.image_path));
    } catch (error) { next(error); }
  });

  app.post("/api/players/:playerId/image", uploadBody, async (req, res, next) => {
    try {
      const current = await authenticatedUser(req, res);
      if (!current) return res.status(401).json({ error: "Authentication required." });
      const id = playerIdSchema.safeParse(req.params.playerId);
      if (!id.success) return res.status(404).json({ error: "Player not found." });
      if (!await canAccessPlayer(current.user.id, id.data)) return res.status(404).json({ error: "Player not found." });
      const { data, error } = await supabaseAdmin.from("players").select("image_path").eq("player_id", id.data).maybeSingle();
      if (error || !data) return res.status(404).json({ error: "Player not found." });
      return await uploadImage(req, res, "players", id.data, data.image_path);
    } catch (error) { next(error); }
  });

  app.delete("/api/players/:playerId/image", async (req, res, next) => {
    try {
      const current = await authenticatedUser(req, res);
      if (!current) return res.status(401).json({ error: "Authentication required." });
      const id = playerIdSchema.safeParse(req.params.playerId);
      if (!id.success) return res.status(404).json({ error: "Player not found." });
      if (!await canAccessPlayer(current.user.id, id.data)) return res.status(404).json({ error: "Player not found." });
      const { data, error } = await supabaseAdmin.from("players").select("image_path").eq("player_id", id.data).maybeSingle();
      if (error || !data) return res.status(404).json({ error: "Player not found." });
      return await deleteImage(res, "players", id.data, data.image_path);
    } catch (error) { next(error); }
  });
}