import { createAdminClient } from '@/lib/supabase/admin'
import { AppShell } from '@/components/app/app-shell'
import { BackLink } from '@/components/app/back-link'
import { nowMs } from '@/lib/domain/time'
import { IntakeSecurityConsole } from './console'
import { requireSurface } from '@/lib/auth/surface-guard'
import { ModeratorAccessCard } from '@/components/app/moderator-access-card'

/**
 * Admin · Intake Security (2026-09-22, §34): submissions today, blocked,
 * duplicates, reviews waiting, pages in protection mode, blocks, limits,
 * recent intake events — with the actions the backend logs.
 */
export default async function IntakeSecurityPage() {
  const { profile, canManage } = await requireSurface('intake_security')
  const admin = createAdminClient()
  const dayAgo = new Date(nowMs() - 86_400_000).toISOString()
  const [subs, pages, blocks, settings, events] = await Promise.all([
    admin.from('intake_submissions').select('id, broker_page_id, status, reason, risk_score, contact_email, source_ip, created_at, trip_id, user_id').gte('created_at', dayAgo).order('created_at', { ascending: false }).limit(300),
    admin.from('broker_pages').select('id, slug, display_name, intake_enabled, who_can_submit, protection_mode, protection_reason, protection_until').order('display_name'),
    admin.from('intake_blocks').select('*').order('created_at', { ascending: false }).limit(100),
    admin.from('intake_settings').select('*').eq('id', 1).maybeSingle(),
    admin.from('security_events').select('event, username, ip, detail, created_at').gte('created_at', dayAgo).order('created_at', { ascending: false }).limit(400),
  ])
  const notReady = !!subs.error && /column|does not exist|schema cache/i.test(subs.error.message)
  const rows = (subs.data ?? []) as { id: string; broker_page_id: string; status: string; reason: string | null; risk_score: number | null; contact_email: string; source_ip: string | null; created_at: string; trip_id: string | null; user_id: string | null }[]
  const intakeEvents = ((events.data ?? []) as { event: string; username: string | null; ip: string | null; detail: Record<string, unknown> | null; created_at: string }[]).filter((e) => typeof e.detail?.kind === 'string' && String(e.detail.kind).startsWith('intake'))
  return (
    <AppShell profile={profile}>
      <main className="mx-auto max-w-6xl space-y-6 px-4 py-8">
        <BackLink />
        <div>
          <h1 className="text-2xl font-bold">Intake security</h1>
          <p className="mt-1 text-sm text-neutral-500">Public broker intake pages — last 24 hours. Every rule is enforced server-side; this is where you see it and adjust it.</p>
          {notReady && <p className="mt-2 rounded-lg bg-amber-50 p-3 text-xs text-amber-800">Migration 0029 is not applied yet — submission statuses, blocks, invitations and limits start recording once it is.</p>}
        </div>
        <IntakeSecurityConsole
          submissions={rows}
          pages={(pages.data ?? []) as { id: string; slug: string; display_name: string; intake_enabled: boolean | null; who_can_submit: string | null; protection_mode: boolean | null; protection_reason: string | null; protection_until: string | null }[]}
          blocks={(blocks.data ?? []) as { id: string; kind: string; value: string; reason: string | null; until: string | null; created_by: string | null; created_at: string }[]}
          limits={(settings.data ?? null) as Record<string, number> | null}
          events={intakeEvents}
        />
      </main>
      <div className="mx-auto max-w-7xl px-4 pb-8">
        <ModeratorAccessCard surface="intake_security" canManage={canManage} />
      </div>
    </AppShell>
  )
}