import { randomUUID } from 'node:crypto';
import * as schema from '@/lib/db/schema';
import { getGameDb, persist } from '@/lib/db/client';
import { createSession, hashPassword } from '@/lib/auth';
import { STARTING_CASH, STARTING_REPUTATION } from '@/lib/game/seed';

// TEST-ONLY hook (v1.1.0, ISS-107) — mints a session for a test player so the e2e suite can hit
// the guarded game routes WITHOUT any real credentials in test code (same reason as its sibling
// /api/test/admin-session). Creates the users + players rows if missing — idempotent across
// container restarts, since the CI DB volume persists. Disabled unless FLIGHT_TEST_HOOKS=1; every
// other deployment 404s here, like its /api/test/* siblings.
//
// POST /api/test/mint-player-session
//   body { username?: string } — defaults to 'e2e-tester'; must match the register rules when given.
//   Returns { sessionId }.

const DEFAULT_USERNAME = 'e2e-tester';
// Test-only credential for the minted users row — e2e never logs in with it (sessions are minted
// server-side); a fixed value keeps the row debuggable from the admin panel.
const TEST_PASSWORD = 'e2e-mint-password-42';

export async function POST(req: Request) {
  if (process.env.FLIGHT_TEST_HOOKS !== '1') {
    return Response.json({ error: 'test hooks disabled' }, { status: 404 });
  }

  let body: unknown = {};
  try {
    const text = await req.text();
    body = text ? JSON.parse(text) : {};
  } catch {
    return Response.json({ error: 'invalid JSON body' }, { status: 400 });
  }
  if (typeof body !== 'object' || body === null || Array.isArray(body)) {
    return Response.json({ error: 'body must be a JSON object' }, { status: 400 });
  }
  const input = body as Record<string, unknown>;
  for (const key of Object.keys(input)) {
    if (key !== 'username') {
      return Response.json({ error: `unknown field "${key}"` }, { status: 400 });
    }
  }
  let username = DEFAULT_USERNAME;
  if (input.username !== undefined) {
    if (typeof input.username !== 'string' || !/^[a-z0-9_-]{3,20}$/.test(input.username)) {
      return Response.json(
        { error: 'username must be 3–20 characters of a-z, 0-9, _ or -' },
        { status: 400 },
      );
    }
    username = input.username;
  }

  const inst = await getGameDb();
  let res = inst.raw.exec('SELECT id FROM users WHERE username = ?', [username]);
  let userId = res[0]?.values?.[0]?.[0];
  if (typeof userId !== 'string') {
    // New test account — one UUID for both rows, starter economy like a fresh world.
    const id = randomUUID();
    inst.raw.run('INSERT INTO users (id, username, password_hash, admin, created_at) VALUES (?, ?, ?, 0, ?)', [
      id,
      username,
      hashPassword(TEST_PASSWORD),
      Date.now(),
    ]);
    await inst.db.insert(schema.players).values({
      id,
      provider: 'local',
      username,
      cash: STARTING_CASH,
      reputation: STARTING_REPUTATION,
    });
    userId = id;
  }
  const sessionId = await createSession(inst, userId); // persists the rows + session together
  return Response.json({ sessionId });
}