import { query } from '../../utils/db'

function parseJwt(token: string) {
  try {
    const base64Payload = token.split('.')[1]
    return JSON.parse(Buffer.from(base64Payload, 'base64').toString('utf8'))
  } catch {
    return null
  }
}

export default defineEventHandler(async (event) => {
  const authHeader = getRequestHeader(event, 'authorization')
  const token = authHeader?.replace('Bearer ', '')

  if (!token) {
    throw createError({ statusCode: 401, statusMessage: 'Missing authorization header' })
  }

  const decoded = parseJwt(token)
  if (!decoded?.sub) {
    throw createError({ statusCode: 401, statusMessage: 'Invalid token' })
  }

  let dbUser = null
  try {
    const result = await query(
      `SELECT sfid, pid, first_login_completed FROM users WHERE keycloak_id = $1 LIMIT 1`,
      [decoded.sub]
    )
    dbUser = result.rows[0] || null
  } catch (error) {
    console.error('[DB PROFILE FETCH ERROR]:', error)
  }

  return {
    keycloakId: decoded.sub,
    username: decoded.preferred_username || decoded.given_name || 'User',
    email: decoded.email,
    sfid: dbUser?.sfid || null,
    pid: dbUser?.pid || null,
    firstLoginCompleted: dbUser?.first_login_completed || false
  }
})