import 'server-only'

import { createAdminClient } from '@/lib/supabase/admin'

/** Supabase Auth owns Google provider details; the app stores only this durable link. */
export async function findAppAccountBySupabaseUserId(supabaseUserId: string): Promise<string | null> {
  const { data, error } = await createAdminClient()
    .from('auth_accounts')
    .select('user_id')
    .eq('supabase_auth_user_id', supabaseUserId)
    .maybeSingle()
  if (error) throw new Error('Could not read the Google account link. Apply migration 0051.')
  return data?.user_id ?? null
}

/** Refuse to replace an existing link or connect one Auth user to two app accounts. */
export async function linkAppAccountToSupabaseUser(input: {
  appUserId: string
  username: string
  supabaseUserId: string
}): Promise<boolean> {
  const admin = createAdminClient()
  const { data: existing, error: readError } = await admin
    .from('auth_accounts')
    .select('supabase_auth_user_id')
    .eq('user_id', input.appUserId)
    .maybeSingle()
  if (readError) throw new Error('Could not read the Google account link. Apply migration 0051.')
  if (existing?.supabase_auth_user_id) return existing.supabase_auth_user_id === input.supabaseUserId

  const now = new Date().toISOString()
  if (existing) {
    const { data, error } = await admin
      .from('auth_accounts')
      .update({ supabase_auth_user_id: input.supabaseUserId, google_connected_at: now, updated_at: now })
      .eq('user_id', input.appUserId)
      .is('supabase_auth_user_id', null)
      .select('user_id')
      .maybeSingle()
    return !error && !!data
  }

  const { error } = await admin.from('auth_accounts').insert({
    user_id: input.appUserId,
    username: input.username.toLowerCase(),
    supabase_auth_user_id: input.supabaseUserId,
    google_connected_at: now,
    updated_by: 'Google sign-in',
    updated_at: now,
  })
  return !error
}