// src/middleware.ts (concept)
import { NextResponse } from 'next/server'
import type { NextRequest } from 'next/server'
import { auth } from '@/lib/auth'; // Import our auth configuration

export async function middleware(request: NextRequest) {
  const session = await auth(); // 1. Get session
  const pathname = request.nextUrl.pathname;

  // 2. If not logged in and accessing protected pages, redirect to login
  if (!session && pathname.startsWith('/dashboard')) {
    return NextResponse.redirect(new URL('/login', request.url));
  }

  if (session && pathname.startsWith('/dashboard')) {
    // 3. [Tenant context]
    //    Here, we should get user's current 'activeOrgId' from cookie or session
    //    Or parse from pathname (e.g., /dashboard/[orgId]/...)
    const activeOrgId = request.cookies.get('active_org_id')?.value;

    if (!activeOrgId && pathname !== '/dashboard/select-org') {
      // 4. If user is logged in but hasn't selected an organization, force them to select
      return NextResponse.redirect(new URL('/dashboard/select-org', request.url));
    }

    // 5. (Advanced) Inject orgId into request headers for Server Components to access
    const requestHeaders = new Headers(request.headers);
    requestHeaders.set('x-org-id', activeOrgId);

    return NextResponse.next({
      request: {
        headers: requestHeaders,
      },
    });
  }

  return NextResponse.next();
}

// ... config matcher ...

// src/db/schema/organizations.ts
import { pgTable, text, varchar } from "drizzle-orm/pg-core";
import { usersTable } from "./users";

// 1. Tenant (Organization) table
export const organizationsTable = pgTable("organizations", {
  id: varchar("id").primaryKey().$defaultFn(() => crypto.randomUUID()),
  name: text("name").notNull(),
});

// 2. Many-to-Many join table
// One user can belong to multiple organizations, one organization can have multiple users
export const usersToOrganizationsTable = pgTable("users_to_organizations", {
  userId: varchar("user_id").notNull().references(() => usersTable.id, { onDelete: "cascade" }),
  organizationId: varchar("organization_id").notNull().references(() => organizationsTable.id, { onDelete: "cascade" }),
  // (Can add a role field: 'admin', 'member')
});

// src/db/schema/projects.ts (modified)
import { organizationsTable } from "./organizations";

export const projectsTable = pgTable("projects", {
  id: varchar("id").primaryKey().$defaultFn(() => crypto.randomUUID()),
  name: text("name").notNull(),

  // [Key] No longer ownerId, but organizationId
  // ownerId only represents creator, but ownership belongs to organization
  organizationId: varchar("organization_id").notNull()
    .references(() => organizationsTable.id, { onDelete: "cascade" }),

  // (Optional) Still keep 'created_by_user_id'
  // ownerId: varchar("owner_id")...
});

// src/data/projects.service.ts
// (Note: This is a .ts file, not a React component)
import { db } from "@/db";
import { projectsTable } from "@/db/schema";
import { and, eq } from "drizzle-orm";

// This is a security context passed from Server Action
// Guarantees the caller must be authenticated and have tenant context
type TenantContext = {
  userId: string;
  orgId: string;
};

/**
 * [Secure] Get single project by ID, tenant isolation enforced
 */
export async function getProjectById(ctx: TenantContext, projectId: string) {

  // Service layer's core responsibility: inject tenant ID
  const project = await db.query.projectsTable.findFirst({
    where: and(
      eq(projectsTable.id, projectId),
      eq(projectsTable.organizationId, ctx.orgId) // <--- [Security line]
    )
  });

  if (!project) {
    // Project not found, or project doesn't belong to tenant, uniformly return null or throw error
    // Never leak information like "project exists but you don't have access"
    return null;
  }

  return project;
}

/**
 * [Secure] Get all projects for current tenant
 */
export async function getProjectsForCurrentOrg(ctx: TenantContext) {
  const projects = await db.select()
    .from(projectsTable)
    .where(
      eq(projectsTable.organizationId, ctx.orgId) // <--- [Security line]
    );

  return projects;
}

// src/actions/project.actions.ts
"use server";

import { auth } from "@/lib/auth";
import { getActiveOrgIdForUser } from "@/data/organizations.service"; // Hypothetical function
import { getProjectById } from "@/data/projects.service"; // Import our secure service
import { createSafeActionClient } from "next-safe-action";
import { z } from "zod";

// ...
const action = createSafeActionClient({
  // 1. Middleware: Automatically get and validate Auth and tenant context
  async middleware() {
    const session = await auth();
    if (!session?.user?.id) throw new Error("Unauthorized");

    // Get current active orgId from cookie or database
    const orgId = await getActiveOrgIdForUser(session.user.id);
    if (!orgId) throw new Error("No active organization found");

    // 2. Pass security context (ctx) to Action
    return { userId: session.user.id, orgId };
  },
});

const getProjectSchema = z.object({
  projectId: z.string(),
});

/**
 * [Secure] A safe action for client-side
 */
export const getProject = action(
  getProjectSchema,
  async ({ projectId }, ctx) => { // <-- ctx from middleware

    // 3. Call service layer, pass security context
    // We're 100% sure this call is tenant-isolated
    const project = await getProjectById(ctx, projectId);

    if (!project) {
      return { error: "Project not found" };
    }

    return { success: true, data: project };
  }
);