// src/server/auth.config.ts
import type { NextAuthConfig } from "next-auth";
import { providers } from "./auth.providers";

export const authConfig: NextAuthConfig = {
  trustHost: true,
  providers,
  pages: {
    signIn: "/login",
    signOut: "/logout",
    error: "/error",
    verifyRequest: "/verify",
  },
  session: { strategy: "jwt" },
  cookies: {
    sessionToken: {
      name: process.env.NODE_ENV === "production"
        ? "__Secure-next-auth.session-token"
        : "next-auth.session-token",
      options: {
        httpOnly: true,
        sameSite: "lax",
        path: "/",
        secure: process.env.NODE_ENV === "production",
      },
    },
  },
  callbacks: {
    authorized({ auth, request: { nextUrl } }) {
      const isLoggedIn = !!auth?.user;
      const isProtected = nextUrl.pathname.startsWith("/dashboard");

      if (isProtected) {
        if (isLoggedIn) return true;
        return false; // Redirect to login
      }
      return true;
    },
  },
};

// src/server/auth.providers.ts
import Discord from "next-auth/providers/discord";
import GitHub from "next-auth/providers/github";
import Google from "next-auth/providers/google";

export const providers = [
  GitHub({
    clientId: env.AUTH_GITHUB_ID,
    clientSecret: env.AUTH_GITHUB_SECRET,
    authorization: {
      params: {
        scope: "read:user user:email",
      },
    },
    profile(profile) {
      return {
        id: profile.id.toString(),
        name: profile.name ?? profile.login,
        email: profile.email,
        image: profile.avatar_url,
        username: profile.login,
      };
    },
  }),
  Google({
    clientId: env.AUTH_GOOGLE_ID,
    clientSecret: env.AUTH_GOOGLE_SECRET,
    authorization: {
      params: {
        scope: "openid email profile",
        prompt: "consent",
      },
    },
  }),
  Discord({
    clientId: env.AUTH_DISCORD_ID,
    clientSecret: env.AUTH_DISCORD_SECRET,
    authorization: {
      params: {
        scope: "identify email",
      },
    },
  }),
].filter(Boolean);

// src/types/next-auth.d.ts
import type { DefaultSession } from "next-auth";

declare module "next-auth" {
  interface Session {
    user: {
      id: string;
      username?: string | null;
      role?: "user" | "admin";
      teamId?: string | null;
      subscription?: {
        isActive: boolean;
        plan: string;
      } | null;
    } & DefaultSession["user"];
  }

  interface User {
    username?: string | null;
    role?: "user" | "admin";
    teamId?: string | null;
    subscription?: {
      isActive: boolean;
      plan: string;
    } | null;
  }
}

declare module "next-auth/jwt" {
  interface JWT {
    id: string;
    username?: string | null;
    role?: "user" | "admin";
    teamId?: string | null;
    subscription?: {
      isActive: boolean;
      plan: string;
    } | null;
  }
}

// src/server/auth.config.ts
callbacks: {
  async signIn({ user, account, profile }) {
    // Log sign-in activity with IP tracking
    await logActivity({
      action: "sign_in",
      category: "auth",
      userId: user.id,
      details: `User signed in via ${account?.provider}`,
      metadata: {
        provider: account?.provider,
        email: user.email,
      },
    });
    return true;
  },

  async jwt({ token, user, trigger, session }) {
    if (user) {
      token.id = user.id;
      token.username = user.username;
      token.role = user.role;
      token.teamId = user.teamId;
      token.subscription = user.subscription;
    }

    // Handle session updates
    if (trigger === "update" && session) {
      return { ...token, ...session };
    }

    return token;
  },

  async session({ session, token }) {
    return {
      ...session,
      user: {
        ...session.user,
        id: token.id,
        username: token.username,
        role: token.role,
        teamId: token.teamId,
        subscription: token.subscription,
      },
    };
  },
}

// src/middleware.ts
import { auth } from "@/server/auth";
import { NextResponse } from "next/server";
import type { NextRequest } from "next/server";

export async function middleware(request: NextRequest) {
  const session = await auth();
  const isProtected = request.nextUrl.pathname.startsWith("/dashboard");
  const isAuthPage = request.nextUrl.pathname.startsWith("/login");

  if (isProtected && !session) {
    const redirectUrl = new URL("/login", request.url);
    redirectUrl.searchParams.set("callbackUrl", request.url);
    return NextResponse.redirect(redirectUrl);
  }

  if (isAuthPage && session) {
    return NextResponse.redirect(new URL("/dashboard", request.url));
  }

  return NextResponse.next();
}

export const config = {
  matcher: ["/dashboard/:path*", "/login"],
};

// src/app/api/protected/route.ts
import { auth } from "@/server/auth";
import { NextResponse } from "next/server";

export async function GET() {
  const session = await auth();

  if (!session) {
    return new NextResponse(null, { status: 401 });
  }

  return NextResponse.json({
    user: session.user,
    message: "This is a protected API route",
  });
}

// src/app/dashboard/page.tsx
import { auth } from "@/server/auth";
import { redirect } from "next/navigation";

export default async function DashboardPage() {
  const session = await auth();

  if (!session) {
    redirect("/login");
  }

  return (
    <div>
      <h1>Welcome, {session.user.name}!</h1>
      <p>Your role: {session.user.role}</p>
    </div>
  );
}

// src/components/user-menu.tsx
"use client";

import { useSession } from "next-auth/react";

export function UserMenu() {
  const { data: session } = useSession();

  if (!session) {
    return <SignInButton />;
  }

  return (
    <div>
      <img src={session.user.image} alt={session.user.name} />
      <span>{session.user.name}</span>
      <SignOutButton />
    </div>
  );
}

// Example auth activity logging
await logActivity({
  action: "sign_in",
  category: "auth",
  userId: user.id,
  details: `User signed in via ${provider}`,
  metadata: {
    provider,
    email: user.email,
  },
});