import type { Metadata } from 'next';
import Link from 'next/link';
import { cookies } from 'next/headers';
import { redirect } from 'next/navigation';
import { ADMIN_COOKIE, adminConfigured, cookieValueFor, isAdmin, tokenMatches } from '@/lib/admin/auth';

export const metadata: Metadata = { title: 'Admin', robots: { index: false, follow: false } };
export const dynamic = 'force-dynamic';

const ADMIN_NAV = [
  { href: '/admin', label: 'Overview' },
  { href: '/admin/connectors', label: 'Connectors' },
  { href: '/admin/unresolved', label: 'Unresolved labels' },
  { href: '/admin/trace', label: 'Trace' },
  { href: '/admin/rankings', label: 'Rankings' },
];

/**
 * Admin console (§140-141, §253). Token via `?token=` once → httpOnly cookie (sha256 of the token)
 * compared to ADMIN_TOKEN. Wrong or missing token renders a login hint instead of the console.
 */
export default async function AdminLayout({ children }: { children: React.ReactNode }) {
  if (!adminConfigured()) {
    return (
      <div className="py-10">
        <p className="ci-kicker">Admin</p>
        <h1 className="text-3xl">Admin console disabled</h1>
        <p className="mt-2 text-[14px] text-ink-2">Set ADMIN_TOKEN in the environment to enable the console.</p>
      </div>
    );
  }
  // Token exchange (`?token=` → cookie + redirect) is handled by src/proxy.ts before this renders.
  const authed = await isAdmin();
  if (!authed) {
    return (
      <div className="py-10">
        <p className="ci-kicker">Admin</p>
        <h1 className="text-3xl">Sign in</h1>
        <p className="mt-2 max-w-xl text-[14px] text-ink-2">Append <code className="ci-mono">?token=&lt;ADMIN_TOKEN&gt;</code> to an admin URL once; a session cookie (hash of the token, httpOnly) is then set and the token is removed from the URL.</p>
        <form action={login} className="mt-4 flex max-w-md gap-2">
          <input name="token" type="password" placeholder="ADMIN_TOKEN" className="flex-1 border border-rule-strong bg-white px-3 py-1.5 text-[14px] outline-none focus:border-accent" aria-label="Admin token" />
          <button type="submit" className="border border-ink bg-ink px-3 py-1.5 text-[14px] text-paper hover:bg-ink-2">
            Sign in
          </button>
        </form>
      </div>
    );
  }
  return (
    <div className="pt-6">
      <div className="flex flex-wrap items-baseline justify-between gap-3 border-b border-rule pb-2">
        <p className="ci-kicker">Admin console · not indexed</p>
        <nav aria-label="Admin" className="flex flex-wrap gap-4 text-[13.5px]">
          {ADMIN_NAV.map((n) => (
            <Link key={n.href} href={n.href} className="text-ink-2 no-underline hover:text-accent">
              {n.label}
            </Link>
          ))}
          <form action={logout}>
            <button type="submit" className="text-ink-3 hover:text-danger">
              Sign out
            </button>
          </form>
        </nav>
      </div>
      {children}
    </div>
  );
}

async function login(formData: FormData) {
  'use server';
  const token = String(formData.get('token') ?? '');
  if (tokenMatches(token)) {
    (await cookies()).set(ADMIN_COOKIE, cookieValueFor(token), { httpOnly: true, sameSite: 'lax', secure: process.env.NODE_ENV === 'production', path: '/', maxAge: 60 * 60 * 12 });
  }
  redirect('/admin');
}

async function logout() {
  'use server';
  (await cookies()).delete(ADMIN_COOKIE);
  redirect('/admin');
}