"use server";

import { getAdminConnection } from "@alga-psa/db/admin";
import { getTenantIdBySlug } from "@alga-psa/db";
import logger from "@alga-psa/core/logger";
import { TIER_FEATURES } from "@alga-psa/types";
import { ensureSsoSettingsPermission } from "@ee/lib/actions/auth/ssoPermissions";
import { assertTenantTierAccess } from "server/src/lib/tier-gating/assertTierAccess";

interface GetLinkedSsoProvidersInput {
  email: string;
  userType: "internal" | "client";
  tenantSlug?: string;
}

interface GetLinkedSsoProvidersResult {
  success: boolean;
  providers: string[];
  twoFactorEnabled: boolean;
}

type LinkedProviderScope = "public" | "settings";

interface GetLinkedSsoProvidersOptions {
  scope?: LinkedProviderScope;
}

export async function getLinkedSsoProvidersAction(
  input: GetLinkedSsoProvidersInput,
  options: GetLinkedSsoProvidersOptions = {}
): Promise<GetLinkedSsoProvidersResult> {
  const email = input.email?.trim().toLowerCase();
  if (!email) {
    return { success: true, providers: [], twoFactorEnabled: false };
  }

  try {
    const scope = options.scope ?? "public";
    if (scope === "settings") {
      await ensureSsoSettingsPermission();
    }
    const knex = await getAdminConnection();

    let tenantId: string | undefined;
    if (input.tenantSlug) {
      tenantId = await getTenantIdBySlug(input.tenantSlug.trim().toLowerCase());
    }

    const userQuery = knex('users')
      .select('user_id', 'tenant', 'two_factor_enabled')
      .where({ email, user_type: input.userType });

    if (tenantId) {
      userQuery.andWhere({ tenant: tenantId });
    }

    const userRecord = await userQuery.first();

    if (!userRecord) {
      return { success: true, providers: [], twoFactorEnabled: false };
    }

    await assertTenantTierAccess(userRecord.tenant, TIER_FEATURES.SSO);

    const links = await knex('user_auth_accounts')
      .select('provider')
      .where({ tenant: userRecord.tenant, user_id: userRecord.user_id });

    const providers = Array.from(new Set(links.map((link) => link.provider))).filter(Boolean);

    return {
      success: true,
      providers,
      twoFactorEnabled: Boolean(userRecord.two_factor_enabled),
    };
  } catch (error) {
    logger.warn('[get-linked-sso-providers] lookup failed', {
      email: input.email,
      userType: input.userType,
      error,
    });

    return {
      success: true,
      providers: [],
      twoFactorEnabled: false,
    };
  }
}
