const express = require("express");
const { query, getOne } = require("../db/queries");
const { requireAuth } = require("../middleware/auth");

const router = express.Router();

async function canAccessProject(userId, projectId) {
  const row = await getOne(
    "SELECT 1 FROM project_members WHERE project_id = ? AND user_id = ?",
    [projectId, userId]
  );
  return Boolean(row);
}

async function getProjectRole(userId, projectId) {
  const row = await getOne(
    "SELECT role FROM project_members WHERE project_id = ? AND user_id = ?",
    [projectId, userId]
  );
  return row?.role || null;
}

router.get("/", requireAuth, async (req, res) => {
  const projectId = req.query.projectId ? Number(req.query.projectId) : null;

  let items;
  if (projectId) {
    const ok = await canAccessProject(req.user.id, projectId);
    if (!ok) return res.status(403).json({ ok: false, message: "forbidden" });
    items = await query("SELECT * FROM boards WHERE project_id = ? ORDER BY position ASC", [projectId]);
  } else {
    items = await query(
      `SELECT b.*\n       FROM boards b\n       JOIN project_members pm ON pm.project_id = b.project_id\n       WHERE pm.user_id = ?\n       ORDER BY b.created_at DESC`,
      [req.user.id]
    );
  }

  res.json({ ok: true, items });
});

router.post("/", requireAuth, async (req, res) => {
  const { projectId, name, description } = req.body || {};
  if (!projectId || !name) return res.status(400).json({ ok: false, message: "missing fields" });

  const ok = await canAccessProject(req.user.id, projectId);
  if (!ok) return res.status(403).json({ ok: false, message: "forbidden" });
  const role = await getProjectRole(req.user.id, projectId);
  if (role === "member") {
    return res.status(403).json({ ok: false, message: "insufficient role" });
  }

  const result = await query(
    "INSERT INTO boards (project_id, name, description, position) VALUES (?, ?, ?, ?)",
    [projectId, name, description || null, 0]
  );
  const board = await getOne("SELECT * FROM boards WHERE id = ?", [result.insertId]);
  res.status(201).json({ ok: true, item: board });
});

router.get("/:id/activity", requireAuth, async (req, res) => {
  const boardId = Number(req.params.id);
  const board = await getOne("SELECT project_id FROM boards WHERE id = ?", [boardId]);
  if (!board) return res.status(404).json({ ok: false, message: "not found" });

  const ok = await canAccessProject(req.user.id, board.project_id);
  if (!ok) return res.status(403).json({ ok: false, message: "forbidden" });

  const items = await query(
    `SELECT a.id, a.type, a.payload, a.created_at, u.name as actor_name
     FROM activities a
     JOIN users u ON u.id = a.actor_id
     WHERE a.board_id = ?
     ORDER BY a.created_at DESC
     LIMIT 200`,
    [boardId]
  );
  res.json({ ok: true, items });
});

module.exports = router;