import { roleGuard } from "@/lib/auth";

export default async function AdminLayout({ children }) {
  await roleGuard("admin", "/dashboard");
  return <>{children}</>;
}

getMetrics: adminProcedure.query(async ({ ctx }) => {
  const [
    activeSessions,
    pendingTickets,
    totalUsers,
    solverStats,
    revenueStats,
    ratingStats,
  ] = await Promise.all([
    db.select({ count: count() }).from(sessions)
      .where(eq(sessions.status, "active")),
    db.select({ count: count() }).from(tickets)
      .where(eq(tickets.status, "pending")),
    db.select({ count: count() }).from(users),
    // ... additional queries
  ]);

  return {
    activeSessions: activeSessions[0]?.count ?? 0,
    pendingTickets: pendingTickets[0]?.count ?? 0,
    // ... formatted metrics
  };
}),

const ROLE_HIERARCHY: Record<UserRole, number> = {
  customer: 1,
  solver: 2,
  admin: 3,
  owner: 4,
};

function canAssignRole(actorRole: UserRole, targetRole: UserRole): boolean {
  if (actorRole === "owner") return true;
  if (actorRole === "admin") {
    return targetRole === "customer" || targetRole === "solver";
  }
  return false;
}

function canModifyUser(
  actorRole: UserRole,
  targetRole: UserRole,
  isSelf: boolean
): boolean {
  if (isSelf) return false;
  if (actorRole === "owner") return true;
  return ROLE_HIERARCHY[actorRole] > ROLE_HIERARCHY[targetRole];
}

updateUserRole: adminProcedure
  .input(z.object({
    userId: z.string().uuid(),
    role: userRoleSchema,
    notes: z.string().optional(),
  }))
  .mutation(async ({ input, ctx }) => {
    const actor = ctx.user;
    const targetUser = await db.query.users.findFirst({
      where: eq(users.id, input.userId),
    });

    // Permission checks
    if (actor.id === targetUser.id) {
      throw new TRPCError({ code: "FORBIDDEN", message: "You cannot change your own role" });
    }
    if (!canModifyUser(actor.role, targetUser.role, false)) {
      throw new TRPCError({ code: "FORBIDDEN", message: `You cannot modify users with ${targetUser.role} role` });
    }
    if (!canAssignRole(actor.role, input.role)) {
      throw new TRPCError({ code: "FORBIDDEN", message: `You cannot assign the ${input.role} role` });
    }

    // Update role
    const [updated] = await db.update(users)
      .set({ role: input.role })
      .where(eq(users.id, input.userId))
      .returning();

    // Create audit log
    await createAuditLog({
      actorId: actor.id,
      action: "role_change",
      targetType: "user",
      targetId: input.userId,
      previousValue: { role: targetUser.role },
      newValue: { role: input.role },
      notes: input.notes,
    });

    return updated;
  }),

suspendUser: adminProcedure
  .input(z.object({
    userId: z.string().uuid(),
    notes: z.string().optional(),
  }))
  .mutation(async ({ input, ctx }) => {
    const actor = ctx.user;
    const targetUser = await db.query.users.findFirst({
      where: eq(users.id, input.userId),
    });

    // Permission checks
    if (actor.id === targetUser.id) {
      throw new TRPCError({ code: "FORBIDDEN", message: "You cannot suspend yourself" });
    }
    if (!canModifyUser(actor.role, targetUser.role, false)) {
      throw new TRPCError({ code: "FORBIDDEN", message: `You cannot suspend users with ${targetUser.role} role` });
    }

    // Create audit log
    await createAuditLog({
      actorId: actor.id,
      action: "user_suspend",
      targetType: "user",
      targetId: input.userId,
      previousValue: { role: targetUser.role },
      notes: input.notes,
    });

    return { success: true };
  }),

export const auditLogs = pgTable("audit_logs", {
  id: uuid("id").primaryKey().defaultRandom(),
  actorId: uuid("actor_id").notNull().references(() => users.id),
  action: auditActionEnum("action").notNull(),
  targetType: varchar("target_type", { length: 50 }).notNull(),
  targetId: uuid("target_id").notNull(),
  previousValue: jsonb("previous_value"),
  newValue: jsonb("new_value"),
  notes: text("notes"),
  ipAddress: varchar("ip_address", { length: 45 }),
  userAgent: text("user_agent"),
  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
});

approveSolver: adminProcedure
  .input(z.object({ solverId: z.string().uuid() }))
  .mutation(async ({ input }) => {
    const solver = await db.query.solvers.findFirst({
      where: eq(solvers.id, input.solverId),
    });

    if (!solver) {
      throw new TRPCError({
        code: "NOT_FOUND",
        message: "Solver not found",
      });
    }

    if (solver.status !== "onboarding") {
      throw new TRPCError({
        code: "BAD_REQUEST",
        message: "Solver is not in onboarding status",
      });
    }

    await db.update(solvers)
      .set({ status: "available" })
      .where(eq(solvers.id, input.solverId));

    return { success: true };
  }),

updateSolver: adminProcedure
  .input(z.object({
    solverId: z.string().uuid(),
    employment: z.enum(["employed", "contract"]).optional(),
    status: solverStatusSchema.optional(),
    googleEmail: z.string().email().optional().nullable(),
    revenueSharePercent: z.number().min(0).max(100).optional(),
    callPreference: z.enum(["in_app", "bridge"]).optional(),
  }))
  .mutation(async ({ input }) => {
    const { solverId, ...updates } = input;
    
    // Only include provided fields
    const updateData: Partial<typeof solvers.$inferInsert> = {};
    if (updates.employment !== undefined) updateData.employment = updates.employment;
    if (updates.status !== undefined) updateData.status = updates.status;
    if (updates.googleEmail !== undefined) updateData.googleEmail = updates.googleEmail;
    if (updates.revenueSharePercent !== undefined) {
      updateData.revenueSharePercent = updates.revenueSharePercent;
    }
    if (updates.callPreference !== undefined) {
      updateData.callPreference = updates.callPreference;
    }

    await db.update(solvers)
      .set(updateData)
      .where(eq(solvers.id, solverId));

    return { success: true };
  }),

app/(authenticated)/admin/
├── layout.tsx           # Role guard and layout wrapper
├── page.tsx             # Overview with metrics
├── users/
│   ├── page.tsx         # User list with search/filter
│   └── [id]/
│       └── page.tsx     # User detail with role management
├── tickets/
│   └── page.tsx         # Ticket list view
├── sessions/
│   └── page.tsx         # Session list view
├── solvers/
│   └── page.tsx         # Solver management
└── applications/
    └── page.tsx         # Solver application review

components/admin/
├── AdminMetrics.tsx     # Metrics display component
└── index.ts             # Component exports

lib/db/schema/
└── audit-logs.ts        # Audit log table and enum

server/routers/
└── admin.ts             # All admin tRPC procedures