const express = require("express");
const router = express.Router();
const pool = require("../../db");
const { strictInput } = require("../../middleware/strict_input");

async function listSessions(req, res) {
  try {
    const { rows } = await pool.query(
      `SELECT id, device_name, created_at, last_used_at
       FROM sessions
       WHERE user_id = $1
       ORDER BY last_used_at DESC`,
      [req.user.id],
    );
    const sessions = rows.map((s) => ({
      ...s,
      current: s.id === req.user.session_id,
    }));
    return res.status(200).json(sessions);
  } catch (err) {
    console.error("list sessions failed", {
      message: err.message,
      code: err.code,
    });
    return res.status(500).send("Sessions could not be retrieved, request failed");
  }
}

async function deleteSession(req, res) {
  try {
    const { id } = req.params;
    const uuidPattern =
      /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
    if (!uuidPattern.test(id)) {
      return res.status(400).send("Invalid session id");
    }
    const result = await pool.query(
      "DELETE FROM sessions WHERE id = $1 AND user_id = $2 RETURNING id",
      [id, req.user.id],
    );
    if (result.rowCount === 0) {
      return res.status(404).send("Session not found or does not belong to you");
    }
    return res.status(200).json({ message: "Session deleted" });
  } catch (err) {
    console.error("delete session failed", {
      message: err.message,
      code: err.code,
    });
    return res.status(500).send("Session could not be deleted, request failed");
  }
}

async function deleteOtherSessions(req, res) {
  if (!req.user.session_id) {
    return res
      .status(400)
      .send("Current session could not be identified, please log in again");
  }
  try {
    await pool.query(
      "DELETE FROM sessions WHERE user_id = $1 AND id != $2",
      [req.user.id, req.user.session_id],
    );
    return res.status(200).json({ message: "Other sessions deleted" });
  } catch (err) {
    console.error("delete other sessions failed", {
      message: err.message,
      code: err.code,
    });
    return res.status(500).send("Sessions could not be deleted, request failed");
  }
}

router.get("/", strictInput(), listSessions);
router.delete("/", strictInput(), deleteOtherSessions);
router.delete("/:id", strictInput(), deleteSession);

module.exports = router;