import { NextRequest, NextResponse } from 'next/server'
import bcrypt from 'bcryptjs'
import prisma from '@/lib/prisma'
import { isAdmin, USER_SAFE_SELECT } from '@/lib/auth-utils'

// GET /api/users (Admin only)
export async function GET(request: NextRequest) {
    try {
        if (!(await isAdmin(request))) {
            return NextResponse.json({ error: 'Accès non autorisé' }, { status: 403 })
        }

        const users = await prisma.user.findMany({
            select: {
                ...USER_SAFE_SELECT,
                businesses: true
            },
            orderBy: { createdAt: 'desc' },
        })
        return NextResponse.json(users)
    } catch (error) {
        console.error('GET /api/users error:', error)
        return NextResponse.json({ error: 'Erreur serveur' }, { status: 500 })
    }
}

// POST /api/users (Admin only — hashes password and whitelists fields)
export async function POST(request: NextRequest) {
    try {
        if (!(await isAdmin(request))) {
            return NextResponse.json({ error: 'Accès non autorisé' }, { status: 403 })
        }

        const body = await request.json()
        const email = body.email?.toLowerCase().trim()
        const name = body.name?.trim()
        const rawPassword = body.password

        if (!email || !name || !rawPassword || rawPassword.length < 8) {
            return NextResponse.json(
                { error: 'Nom, email et mot de passe (min. 8 caractères) requis' },
                { status: 400 }
            )
        }

        const hashedPassword = await bcrypt.hash(rawPassword, 10)
        const allowedRole = ['VISITOR', 'ENTREPRENEUR', 'ADMIN'].includes(body.role)
            ? body.role
            : 'VISITOR'

        const user = await prisma.user.create({ 
            data: {
                name,
                email,
                password: hashedPassword,
                role: allowedRole,
                phone: body.phone || null,
                bio: body.bio || null,
                location: body.location || null,
                emailVerified: true,
            },
            select: USER_SAFE_SELECT
        })
        return NextResponse.json(user, { status: 201 })
    } catch (error) {
        console.error('POST /api/users error:', error)
        return NextResponse.json({ error: 'Erreur lors de la création' }, { status: 500 })
    }
}