import type { Metadata } from "next";
import { cookies } from "next/headers";
import { redirect } from "next/navigation";
import { ShieldCheck, UserRound } from "lucide-react";

import { prisma } from "@/lib/prisma";
import {
  AUTH_COOKIE_NAME,
} from "@/lib/auth/constants";
import {
  hashSessionToken,
  isValidSessionTokenFormat,
} from "@/lib/auth/session-token";
import {
  loadAuthorizationForUser,
} from "@/lib/auth/authorization";

import AdminLogoutButton from "./AdminLogoutButton";

export const metadata: Metadata = {
  title: "Admin Dashboard",
  robots: {
    index: false,
    follow: false,
  },
};

export const dynamic = "force-dynamic";

export default async function AdminDashboardPage() {
  const cookieStore = await cookies();
  const token =
    cookieStore.get(AUTH_COOKIE_NAME)?.value;

  if (
    !token ||
    !isValidSessionTokenFormat(token)
  ) {
    redirect("/admin/login");
  }

  const session = await prisma.authSession.findUnique({
    where: {
      tokenHash: hashSessionToken(token),
    },
    select: {
      userId: true,
      expiresAt: true,
      revokedAt: true,
    },
  });

  if (
    !session ||
    session.revokedAt !== null ||
    session.expiresAt.getTime() <= Date.now()
  ) {
    redirect("/admin/login");
  }

  const authorization =
    await loadAuthorizationForUser(session.userId);

  if (
    !authorization ||
    authorization.status !== "ACTIVE" ||
    !authorization.roles.includes("SUPER_ADMIN")
  ) {
    redirect("/admin/login");
  }

  if (authorization.mustChangePassword) {
    redirect("/admin/change-password");
  }

  return (
    <main className="min-h-[75vh] bg-[var(--soft)] px-5 py-14">
      <div className="container">
        <div className="mb-8 flex flex-wrap items-center justify-between gap-5">
          <div>
            <p className="mb-2 text-xs font-bold uppercase tracking-[0.18em] text-[var(--blue)]">
              Teja Technology CRM
            </p>

            <h1 className="text-3xl font-bold text-[var(--navy)]">
              Admin Dashboard
            </h1>

            <p className="mt-2 text-sm text-[var(--muted)]">
              Secure administrator workspace
            </p>
          </div>

          <AdminLogoutButton />
        </div>

        <section className="rounded-2xl border border-[var(--line)] bg-white p-7 shadow-sm">
          <div className="mb-5 flex items-center gap-3">
            <ShieldCheck
              size={25}
              className="text-[var(--blue)]"
            />

            <h2 className="text-xl font-bold text-[var(--navy)]">
              Administrator access verified
            </h2>
          </div>

          <div className="flex items-start gap-4">
            <UserRound
              size={22}
              className="mt-1 shrink-0 text-[var(--muted)]"
            />

            <div className="min-w-0">
              <p className="font-semibold text-[var(--ink)]">
                {authorization.name}
              </p>

              <p className="mt-1 break-all text-sm text-[var(--muted)]">
                {authorization.email}
              </p>

              <p className="mt-2 text-xs font-semibold text-[var(--blue)]">
                SUPER_ADMIN
              </p>
            </div>
          </div>

          {authorization.mustChangePassword && (
            <p
              role="alert"
              className="mt-6 rounded-xl border border-amber-200 bg-amber-50 p-4 text-sm text-amber-900"
            >
              Password change is required. CRM management
              features will remain unavailable until the
              password-change workflow is implemented.
            </p>
          )}
        </section>

        <p className="mt-6 text-sm text-[var(--muted)]">
          CRM modules and reporting will be added after
          authentication and authorization testing.
        </p>
      </div>
    </main>
  );
}