// GET /api/internal/users — 供 OA 查询 assets 用户列表
// POST /api/internal/users — 供 OA 同步用户角色
import { NextRequest, NextResponse } from 'next/server'
import db from '@/lib/db'

const INTERNAL_KEY = process.env.INTERNAL_API_KEY || 'oa-internal-key-tlyq-2026'

export async function GET(request: NextRequest) {
  const key = request.headers.get('x-internal-key')
  if (key !== INTERNAL_KEY) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })

  const users = db.prepare(
    'SELECT username, display_name, role FROM users WHERE is_active = 1 ORDER BY username'
  ).all() as { username: string; display_name: string; role: string }[]
  return NextResponse.json({ users })
}

export async function POST(request: NextRequest) {
  const key = request.headers.get('x-internal-key')
  if (key !== INTERNAL_KEY) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })

  const body = await request.json()
  const { username, displayName, role } = body
  if (!username) {
    return NextResponse.json({ error: 'username 必填' }, { status: 400 })
  }
  const VALID_ROLES = ['admin', 'editor', 'viewer']
  const safeRole = VALID_ROLES.includes(role) ? role : 'viewer'

  try {
    db.prepare(
      `INSERT INTO users (username, password_hash, display_name, role, is_active, created_at, updated_at)
       VALUES (?, '', ?, ?, 1, datetime('now', '+8 hours'), datetime('now', '+8 hours'))
       ON CONFLICT(username) DO UPDATE SET role = ?, display_name = ?,
       updated_at = datetime('now', '+8 hours')`
    ).run(username, displayName || username, safeRole, safeRole, displayName || username)
    return NextResponse.json({ success: true })
  } catch {
    return NextResponse.json({ error: '同步失败' }, { status: 500 })
  }
}