import { NextRequest, NextResponse } from "next/server";
import { createHmac } from "crypto";
import { getSession } from "../../../lib/auth";
import { getPlatformDb } from "../../../lib/platform-db";

export async function GET(request: NextRequest) {
  const session = await getSession();
  if (!session) return NextResponse.redirect(new URL("/login", request.url));

  const accountId = Number(request.nextUrl.searchParams.get("account_id"));
  const slug = request.nextUrl.searchParams.get("slug");
  if (!accountId || !slug) return NextResponse.redirect(new URL("/tenants", request.url));

  const db = getPlatformDb();
  const user = db
    .prepare("SELECT id FROM users WHERE account_id = ? AND role = 'admin' LIMIT 1")
    .get(accountId) as { id: number } | undefined;

  if (!user) return NextResponse.redirect(new URL("/tenants?error=no-admin", request.url));

  const secret = process.env.AUTO_LOGIN_SECRET!;
  const expires = Date.now() + 60_000;
  const payload = `${user.id}:${accountId}:${expires}`;
  const sig = createHmac("sha256", secret).update(payload).digest("hex");
  const token = encodeURIComponent(`${payload}:${sig}`);

  return NextResponse.redirect(`https://${slug}.rikxplatform.nl/auto-login?token=${token}`);
}