import express from 'express';
import { DataTypes } from 'sequelize';
import { Client } from 'ldapts';
import defineLdapSetting from '../../models/ldapSettings.js';
import authMiddleware from '../../middleware/auth.js';
import { authenticateLdap, getLdapSettings } from './ldapClient.js';
const router = express.Router();

export default function (sequelize) {
  const { verifySignedIn, verifyAdmin } = authMiddleware(sequelize);
  const LdapSetting = defineLdapSetting(sequelize, DataTypes);

  router.post('/test', verifySignedIn, verifyAdmin, async (req, res) => {
    try {
      const stored = await getLdapSettings(LdapSetting);

      // Use the values from the form, falling back to the stored bind
      // password when the (masked) field is left empty.
      const settings = {
        url: req.body.url ?? stored.url,
        bindDn: req.body.bindDn ?? stored.bindDn,
        bindCredentials: req.body.bindCredentials || stored.bindCredentials,
        searchBase: req.body.searchBase ?? stored.searchBase,
        searchFilter: req.body.searchFilter ?? stored.searchFilter,
        emailAttribute: req.body.emailAttribute ?? stored.emailAttribute,
        usernameAttribute: req.body.usernameAttribute ?? stored.usernameAttribute,
      };

      if (!settings.url) {
        return res.status(400).json({ ok: false, message: 'Server URL is required' });
      }

      const { testUsername, testPassword } = req.body;
      if (testUsername && testPassword) {
        const user = await authenticateLdap(settings, testUsername, testPassword);
        return res.json({ ok: true, user });
      }

      // No test user supplied: just verify connectivity and the service bind.
      const client = new Client({ url: settings.url });
      try {
        await client.bind(settings.bindDn, settings.bindCredentials);
      } finally {
        try {
          await client.unbind();
        } catch {
          // ignore
        }
      }
      return res.json({ ok: true });
    } catch (error) {
      return res.status(200).json({ ok: false, message: error.message || 'LDAP test failed' });
    }
  });

  return router;
}