import { fail, redirect } from '@sveltejs/kit';
import type { RequestEvent } from '@sveltejs/kit';
import { pbAdmin } from '$lib/server/pocketbase';
import { createPbClient } from '$lib/server/pocketbase';
import { setSessionCookie } from '$lib/server/session';
import { issueAccess } from '$lib/server/member-otp';
import { slugify, handle, famUsername, handleOf } from '@shared/slugify';

class SignupError extends Error {}

export const actions = {
	// Step 1 — create the family + parent (admin) user, mint their session.
	// The parent's human-entered name is kept as the display `name`; their PB
	// `username` is `{famSlug}:{handle}` (globally unique, handle = no whitespace).
	signup: async (event) => {
		const fd = await event.request.formData();
		const famName = fd.get('familyName') as string;
		const yourName = (fd.get('yourName') as string) || '';
		const email = fd.get('email') as string;
		const password = fd.get('password') as string;

		if (!famName || !yourName || !email || !password) {
			return fail(400, { message: 'All fields required', famName, email });
		}
		if (password.length < 8) {
			return fail(400, { message: 'Password must be at least 8 characters', famName, email });
		}

		const parentName = yourName.trim();
		const slug = slugify(famName);
		const handleName = handle(parentName) || 'admin';
		const username = famUsername(slug, handleName);

		try {
			const fam = await pbAdmin.create('fams', {
				name: famName,
				slug,
				timezone: 'auto'
			});
			const user = await pbAdmin.create('users', {
				username,
				name: parentName,
				email,
				password,
				passwordConfirm: password,
				emailVisibility: false,
				famId: fam.id,
				role: 'parent'
			});
			await pbAdmin.create('settings', { famId: fam.id });
		} catch (e) {
			throw new SignupError(
				`Could not create account — ${e instanceof Error ? e.message : 'please try again'}`
			);
		}

		// Auth as the new parent to mint their JWT, then move to the child step.
		const authResult = await createPbClient()
			.collection('users')
			.authWithPassword(email, password)
			.catch(() => null);
		if (authResult?.token) setSessionCookie(event.cookies, authResult.token);

		// `username` here is the handle (URL segment), not the composite.
		return { success: true, famSlug: slug, username: handleName };
	},

	// Step 2 — optionally add a child now; issues their OTP join code.
	child: async (event: RequestEvent) => {
		const user = requireUser(event);
		const fd = await event.request.formData();
		const name = ((fd.get('member') as string) || '').trim();

		const fam = await pbAdmin.getOne('fams', user.famId);
		const famSlug = fam?.slug || user.famId;

		if (!name) {
			return { success: true, famSlug, username: handleOf(user.username) };
		}

		const { otp, joinUrl } = await issueAccess({
			famId: user.famId,
			famSlug,
			name
		});

		return { success: true, code: otp, joinUrl, famSlug, username: handleOf(user.username) };
	}
};

function requireUser(event: RequestEvent) {
	if (!event.locals.user) throw redirect(303, '/signup');
	return event.locals.user;
}