import { NextRequest } from "next/server";

import {
  clearAuthCookie,
  getAccessToken,
  getHermesUrl,
  hermesJsonResponse,
  unauthorizedResponse,
  upstreamConfigurationErrorResponse,
  upstreamUnavailableResponse,
} from "@/lib/server/hermes";
import { assertSameOrigin } from "@/lib/server/request-guards";

type Params = {
  params: Promise<{
    id: string;
  }>;
};

async function proxyUserRequest(request: NextRequest, { params }: Params) {
  const token = await getAccessToken();

  if (!token) {
    return unauthorizedResponse();
  }

  const hermesUrl = getHermesUrl();

  if (!hermesUrl) {
    return upstreamConfigurationErrorResponse();
  }

  const { id } = await params;
  const action = request.nextUrl.searchParams.get("action");
  const path = action === "password" ? `/users/${id}/password` : `/users/${id}`;

  let hermesResponse: Response;

  try {
    hermesResponse = await fetch(`${hermesUrl}${path}`, {
      method: request.method,
      headers: {
        Authorization: `Bearer ${token}`,
        Accept: "application/json",
        "Content-Type": "application/json",
      },
      body: request.method === "GET" || request.method === "DELETE"
        ? undefined
        : await request.text(),
      cache: "no-store",
    });
  } catch {
    return upstreamUnavailableResponse();
  }

  if (hermesResponse.status === 401) {
    const response = await hermesJsonResponse(hermesResponse);
    clearAuthCookie(response);
    return response;
  }

  return hermesJsonResponse(hermesResponse);
}

export async function GET(request: NextRequest, context: Params) {
  return proxyUserRequest(request, context);
}

export async function PUT(request: NextRequest, context: Params) {
  const originError = assertSameOrigin(request);

  if (originError) {
    return originError;
  }

  return proxyUserRequest(request, context);
}

export async function DELETE(request: NextRequest, context: Params) {
  const originError = assertSameOrigin(request);

  if (originError) {
    return originError;
  }

  return proxyUserRequest(request, context);
}