// Shared guard for the admin security-key routes (server/api/admin/users/[id]/webauthn/*).
// Caller must have a session AND a tenant-administrator role (AD_Role.IsClientAdministrator,
// resolved against iDempiere by isAdminRole — never trusted from the client-writable cookie).
import { isAdminRole } from './changeLogHelper'
import fetchHelper from './fetchHelper'

export interface KeyAdminContext {
  adminId: number
  token: string
  targetUserId: number
}

export async function requireKeyAdmin(event: any): Promise<KeyAdminContext> {
  const adminId = Number(getCookie(event, 'logship_user_id'))
  const token = getCookie(event, 'logship_it') ?? ''
  if (!adminId || !token) {
    throw createError({ statusCode: 401, statusMessage: 'Not authenticated' })
  }
  const targetUserId = Number(getRouterParam(event, 'id'))
  if (!targetUserId) {
    throw createError({ statusCode: 400, statusMessage: 'Missing user id' })
  }
  if (!(await isAdminRole(event, token))) {
    throw createError({ statusCode: 403, statusMessage: 'Tenant administrator role required' })
  }
  return { adminId, token, targetUserId }
}

/** Target user's login name + display name (admin token; falls back to the id). */
export async function fetchTargetUser(event: any, ctx: KeyAdminContext): Promise<{ userName: string; displayName: string }> {
  const rec: any = await fetchHelper(event, 'models/ad_user/' + ctx.targetUserId + '?$select=Name,Value', 'GET', ctx.token, null)
    .catch(() => null)
  if (!rec) throw createError({ statusCode: 404, statusMessage: 'User not found' })
  const userName = String(rec.Name ?? rec.name ?? rec.Value ?? rec.value ?? ctx.targetUserId)
  return { userName, displayName: String(rec.Name ?? rec.name ?? userName) }
}