core/server/handlers/teams.go

package handlers

import (
	"database/sql"
	"encoding/json"
	"fmt"
	"log"
	"net/http"
	"strconv"
	"strings"
	"time"

	"github.com/gin-gonic/gin"

	"git.gobha.me/xcaliber/chat-switchboard/crypto"
	"git.gobha.me/xcaliber/chat-switchboard/database"
	"git.gobha.me/xcaliber/chat-switchboard/models"
	"git.gobha.me/xcaliber/chat-switchboard/providers"
	"git.gobha.me/xcaliber/chat-switchboard/store"
)

// ── Request types ───────────────────────────

type createTeamRequest struct {
	Name        string `json:"name" binding:"required,min=1,max=200"`
	Description string `json:"description,omitempty"`
}

type updateTeamRequest struct {
	Name        *string `json:"name,omitempty"`
	Description *string `json:"description,omitempty"`
	IsActive    *bool   `json:"is_active,omitempty"`
	Settings    *string `json:"settings,omitempty"` // JSON string
}

type addMemberRequest struct {
	UserID string `json:"user_id" binding:"required"`
	Role   string `json:"role" binding:"required,oneof=admin member"`
}

type updateMemberRequest struct {
	Role string `json:"role" binding:"required,oneof=admin member"`
}

// ── Handler ─────────────────────────────────

type TeamHandler struct{
	stores store.Stores
	vault  *crypto.KeyResolver
}

func NewTeamHandler(s store.Stores, vault *crypto.KeyResolver) *TeamHandler {
	return &TeamHandler{stores: s, vault: vault}
}

// ── Admin: List All Teams ───────────────────

func (h *TeamHandler) ListTeams(c *gin.Context) {
	page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
	perPage, _ := strconv.Atoi(c.DefaultQuery("per_page", "50"))
	if page < 1 {
		page = 1
	}
	if perPage < 1 || perPage > 100 {
		perPage = 50
	}

	all, err := h.stores.Teams.List(c.Request.Context())
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{"error": "query failed"})
		return
	}
	if all == nil {
		all = []models.Team{}
	}
	total := len(all)

	// In-memory pagination (teams are low-cardinality)
	offset := (page - 1) * perPage
	end := offset + perPage
	if offset > total {
		offset = total
	}
	if end > total {
		end = total
	}

	c.JSON(http.StatusOK, gin.H{
		"data":     all[offset:end],
		"total":    total,
		"page":     page,
		"per_page": perPage,
	})
}

// ── Admin: Create Team ──────────────────────

func (h *TeamHandler) CreateTeam(c *gin.Context) {
	adminID := getUserID(c)

	var req createTeamRequest
	if err := c.ShouldBindJSON(&req); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
		return
	}

	team := &models.Team{
		Name:        req.Name,
		Description: req.Description,
		CreatedBy:   adminID,
		IsActive:    true,
	}
	if err := h.stores.Teams.Create(c.Request.Context(), team); err != nil {
		if database.IsUniqueViolation(err) {
			c.JSON(http.StatusConflict, gin.H{"error": "team name already exists"})
			return
		}
		c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to create team"})
		return
	}

	c.JSON(http.StatusCreated, gin.H{"id": team.ID, "name": team.Name})
	AuditLog(h.stores.Audit, c, "team.create", "team", team.ID, map[string]interface{}{"name": team.Name})
}

// ── Admin: Get Team ─────────────────────────

func (h *TeamHandler) GetTeam(c *gin.Context) {
	teamID := c.Param("id")

	team, err := h.stores.Teams.GetByID(c.Request.Context(), teamID)
	if err == sql.ErrNoRows {
		c.JSON(http.StatusNotFound, gin.H{"error": "team not found"})
		return
	}
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{"error": "query failed"})
		return
	}

	c.JSON(http.StatusOK, team)
}

// ── Admin: Update Team ──────────────────────

func (h *TeamHandler) UpdateTeam(c *gin.Context) {
	teamID := c.Param("id")

	var req updateTeamRequest
	if err := c.ShouldBindJSON(&req); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
		return
	}

	// Build dynamic update
	sets := []string{}
	args := []interface{}{}
	argN := 1

	addArg := func(col string, val interface{}) {
		if database.IsSQLite() {
			sets = append(sets, col+" = ?")
		} else {
			sets = append(sets, col+" = $"+strconv.Itoa(argN))
		}
		args = append(args, val)
		argN++
	}

	if req.Name != nil {
		addArg("name", *req.Name)
	}
	if req.Description != nil {
		addArg("description", *req.Description)
	}
	if req.IsActive != nil {
		addArg("is_active", *req.IsActive)
	}
	if req.Settings != nil {
		if database.IsSQLite() {
			// SQLite: json_patch for merge
			sets = append(sets, "settings = json_patch(COALESCE(settings, '{}'), ?)")
		} else {
			sets = append(sets, "settings = COALESCE(settings, '{}'::jsonb) || $"+strconv.Itoa(argN)+"::jsonb")
		}
		args = append(args, *req.Settings)
		argN++
	}

	if len(sets) == 0 {
		c.JSON(http.StatusBadRequest, gin.H{"error": "no fields to update"})
		return
	}

	var whereClause string
	if database.IsSQLite() {
		whereClause = " WHERE id = ?"
	} else {
		whereClause = " WHERE id = $" + strconv.Itoa(argN)
	}
	args = append(args, teamID)

	query := "UPDATE teams SET " + strings.Join(sets, ", ") + whereClause

	res, err := database.DB.Exec(query, args...)
	if err != nil {
		if database.IsUniqueViolation(err) {
			c.JSON(http.StatusConflict, gin.H{"error": "team name already exists"})
			return
		}
		c.JSON(http.StatusInternalServerError, gin.H{"error": "update failed"})
		return
	}
	if n, _ := res.RowsAffected(); n == 0 {
		c.JSON(http.StatusNotFound, gin.H{"error": "team not found"})
		return
	}

	c.JSON(http.StatusOK, gin.H{"ok": true})
	AuditLog(h.stores.Audit, c, "team.update", "team", teamID, nil)
}

// ── Admin: Delete Team ──────────────────────

func (h *TeamHandler) DeleteTeam(c *gin.Context) {
	teamID := c.Param("id")
	ctx := c.Request.Context()

	// Verify existence
	if _, err := h.stores.Teams.GetByID(ctx, teamID); err != nil {
		if err == sql.ErrNoRows {
			c.JSON(http.StatusNotFound, gin.H{"error": "team not found"})
			return
		}
		c.JSON(http.StatusInternalServerError, gin.H{"error": "delete failed"})
		return
	}

	if err := h.stores.Teams.Delete(ctx, teamID); err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{"error": "delete failed"})
		return
	}

	c.JSON(http.StatusOK, gin.H{"ok": true})
	AuditLog(h.stores.Audit, c, "team.delete", "team", teamID, nil)
}

// ── Members: List ───────────────────────────

func (h *TeamHandler) ListMembers(c *gin.Context) {
	teamID := getTeamID(c)

	members, err := h.stores.Teams.ListMembers(c.Request.Context(), teamID)
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{"error": "query failed"})
		return
	}
	if members == nil {
		members = []models.TeamMember{}
	}

	c.JSON(http.StatusOK, gin.H{"data": members})
}

// ── Members: Add ────────────────────────────

func (h *TeamHandler) AddMember(c *gin.Context) {
	teamID := getTeamID(c)

	var req addMemberRequest
	if err := c.ShouldBindJSON(&req); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
		return
	}

	// Verify team exists
	var exists bool
	database.DB.QueryRow(database.Q(`SELECT EXISTS(SELECT 1 FROM teams WHERE id = $1)`), teamID).Scan(&exists)
	if !exists {
		c.JSON(http.StatusNotFound, gin.H{"error": "team not found"})
		return
	}

	// Verify user exists
	database.DB.QueryRow(database.Q(`SELECT EXISTS(SELECT 1 FROM users WHERE id = $1)`), req.UserID).Scan(&exists)
	if !exists {
		c.JSON(http.StatusBadRequest, gin.H{"error": "user not found"})
		return
	}

	id, err := database.InsertReturningID(`
		INSERT INTO team_members (team_id, user_id, role)
		VALUES ($1, $2, $3)
		RETURNING id
	`, teamID, req.UserID, req.Role)
	if err != nil {
		if database.IsUniqueViolation(err) {
			c.JSON(http.StatusConflict, gin.H{"error": "user is already a member"})
			return
		}
		c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to add member"})
		return
	}

	c.JSON(http.StatusCreated, gin.H{"id": id})
	AuditLog(h.stores.Audit, c, "team.add_member", "team", getTeamID(c), map[string]interface{}{
		"user_id": req.UserID, "role": req.Role,
	})
}

// ── Members: Update Role ────────────────────

func (h *TeamHandler) UpdateMember(c *gin.Context) {
	teamID := getTeamID(c)
	memberID := c.Param("memberId")

	var req updateMemberRequest
	if err := c.ShouldBindJSON(&req); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
		return
	}

	res, err := database.DB.Exec(database.Q(`
		UPDATE team_members SET role = $1 WHERE id = $2 AND team_id = $3
	`), req.Role, memberID, teamID)
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{"error": "update failed"})
		return
	}
	if n, _ := res.RowsAffected(); n == 0 {
		c.JSON(http.StatusNotFound, gin.H{"error": "member not found"})
		return
	}

	c.JSON(http.StatusOK, gin.H{"ok": true})
	AuditLog(h.stores.Audit, c, "team.update_member", "team", getTeamID(c), map[string]interface{}{
		"member_id": memberID, "role": req.Role,
	})
}

// ── Members: Remove ─────────────────────────

func (h *TeamHandler) RemoveMember(c *gin.Context) {
	teamID := getTeamID(c)
	memberID := c.Param("memberId")

	res, err := database.DB.Exec(database.Q(`DELETE FROM team_members WHERE id = $1 AND team_id = $2`), memberID, teamID)
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{"error": "remove failed"})
		return
	}
	if n, _ := res.RowsAffected(); n == 0 {
		c.JSON(http.StatusNotFound, gin.H{"error": "member not found"})
		return
	}

	c.JSON(http.StatusOK, gin.H{"ok": true})
	AuditLog(h.stores.Audit, c, "team.remove_member", "team", getTeamID(c), map[string]interface{}{
		"member_id": memberID,
	})
}

// ── User: My Teams ──────────────────────────

func (h *TeamHandler) MyTeams(c *gin.Context) {
	userID := getUserID(c)

	teams, err := h.stores.Teams.ListForUser(c.Request.Context(), userID)
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{"error": "query failed"})
		return
	}
	if teams == nil {
		teams = []models.Team{}
	}

	c.JSON(http.StatusOK, gin.H{"data": teams})
}

// ── Team Models: Available for Personas ──────

// ListAvailableModels returns models with visibility 'enabled' or 'team'
// for team admins building personas. Requires RequireTeamAdmin middleware.
// GET /api/v1/teams/:teamId/models
func (h *TeamHandler) ListAvailableModels(c *gin.Context) {
	teamID := getTeamID(c)

	type availableModel struct {
		ID           string  `json:"id"`
		ModelID      string  `json:"model_id"`
		DisplayName  *string `json:"display_name"`
		Visibility   string  `json:"visibility"`
		Provider     string  `json:"provider"`
		ProviderName string  `json:"provider_name"`
		Source       string  `json:"source"`
	}

	models := make([]availableModel, 0)

	// ── 1. Global admin models (synced in model_catalog) ──
	rows, err := database.DB.Query(database.Q(`
		SELECT mc.id, mc.model_id, mc.display_name, mc.visibility,
		       ac.provider, ac.name as provider_name
		FROM model_catalog mc
		JOIN provider_configs ac ON mc.provider_config_id = ac.id
		WHERE mc.visibility IN ('enabled', 'team')
		  AND ac.is_active = true AND ac.scope = 'global'
		ORDER BY ac.name, mc.model_id
	`))
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{"error": "query failed"})
		return
	}
	defer rows.Close()

	for rows.Next() {
		var m availableModel
		if err := rows.Scan(&m.ID, &m.ModelID, &m.DisplayName, &m.Visibility,
			&m.Provider, &m.ProviderName); err != nil {
			continue
		}
		m.Source = "global"
		models = append(models, m)
	}

	// ── 2. Team provider models (live query) ──
	teamRows, err := database.DB.Query(database.Q(`
		SELECT id, name, provider, endpoint, api_key_enc, headers
		FROM provider_configs
		WHERE scope = 'team' AND owner_id = $1 AND is_active = true
	`), teamID)
	if err == nil {
		defer teamRows.Close()
		for teamRows.Next() {
			var cfgID, name, providerID, endpoint string
			var apiKey *string
			var headersJSON []byte
			if err := teamRows.Scan(&cfgID, &name, &providerID, &endpoint, &apiKey, &headersJSON); err != nil {
				continue
			}

			provider, pErr := providers.Get(providerID)
			if pErr != nil {
				continue
			}

			key := ""
			if apiKey != nil {
				key = *apiKey
			}

			var customHeaders map[string]string
			_ = json.Unmarshal(headersJSON, &customHeaders)

			provModels, lErr := provider.ListModels(c.Request.Context(), providers.ProviderConfig{
				Endpoint:      endpoint,
				APIKey:        key,
				CustomHeaders: customHeaders,
			})
			if lErr != nil {
				log.Printf("[models] team provider %q list failed: %v", name, lErr)
				continue
			}

			for _, pm := range provModels {
				models = append(models, availableModel{
					ID:           pm.ID,
					ModelID:      pm.ID,
					Provider:     providerID,
					ProviderName: name,
					Visibility:   "enabled",
					Source:       "team",
				})
			}
		}
	}

	c.JSON(http.StatusOK, gin.H{"models": models})
}

// ── Helpers ─────────────────────────────────

// getTeamID extracts team ID from either :id (admin routes) or :teamId (team-scoped routes).
func getTeamID(c *gin.Context) string {
	if id := c.Param("teamId"); id != "" {
		return id
	}
	return c.Param("id")
}

// IsTeamAdmin checks if a user is an admin of the given team.
func IsTeamAdmin(userID, teamID string) bool {
	var role string
	err := database.DB.QueryRow(database.Q(`
		SELECT role FROM team_members WHERE team_id = $1 AND user_id = $2
	`), teamID, userID).Scan(&role)
	return err == nil && role == "admin"
}

// IsTeamMember checks if a user belongs to the given team (any role).
func IsTeamMember(userID, teamID string) bool {
	var exists bool
	database.DB.QueryRow(database.Q(`
		SELECT EXISTS(SELECT 1 FROM team_members WHERE team_id = $1 AND user_id = $2)
	`), teamID, userID).Scan(&exists)
	return exists
}

// enforcePrivateProviderPolicy checks if a user belongs to any team that
// requires private providers, and if so, verifies the resolved config is
// marked as private. Returns nil if allowed, error if blocked.
func enforcePrivateProviderPolicy(userID, configID string) error {
	if configID == "" {
		return nil
	}

	// Check if user belongs to any team with require_private_providers policy
	var requiresPrivate bool
	var query string
	if database.IsSQLite() {
		query = `
			SELECT EXISTS(
				SELECT 1 FROM team_members tm
				JOIN teams t ON t.id = tm.team_id
				WHERE tm.user_id = ?
				  AND t.is_active = 1
				  AND json_extract(t.settings, '$.require_private_providers') = 'true'
			)`
	} else {
		query = `
			SELECT EXISTS(
				SELECT 1 FROM team_members tm
				JOIN teams t ON t.id = tm.team_id
				WHERE tm.user_id = $1
				  AND t.is_active = true
				  AND t.settings->>'require_private_providers' = 'true'
			)`
	}
	err := database.DB.QueryRow(query, userID).Scan(&requiresPrivate)
	if err != nil || !requiresPrivate {
		return nil
	}

	// User is in a restricted team — verify the config is private
	var isPrivate bool
	err = database.DB.QueryRow(database.Q(`
		SELECT COALESCE(is_private, false) FROM provider_configs WHERE id = $1
	`), configID).Scan(&isPrivate)
	if err != nil {
		return nil // config lookup failed, allow (fail open)
	}
	if !isPrivate {
		return fmt.Errorf("your team requires private providers — this provider sends data externally")
	}
	return nil
}

// ── Team Audit Log (scoped to team members) ─

func (h *TeamHandler) ListTeamAuditLog(c *gin.Context) {
	teamID := c.Param("teamId")
	page, perPage, offset := parsePagination(c)

	// Build filter clauses — always scoped to team members.
	// Use ? placeholders and convert for Postgres if needed.
	clauses := []string{"al.actor_id IN (SELECT user_id FROM team_members WHERE team_id = ?)"}
	args := []interface{}{teamID}

	if action := c.Query("action"); action != "" {
		clauses = append(clauses, "al.action = ?")
		args = append(args, action)
	}
	if actorID := c.Query("actor_id"); actorID != "" {
		clauses = append(clauses, "al.actor_id = ?")
		args = append(args, actorID)
	}
	if rt := c.Query("resource_type"); rt != "" {
		clauses = append(clauses, "al.resource_type = ?")
		args = append(args, rt)
	}

	where := "WHERE " + strings.Join(clauses, " AND ")

	// For Postgres, convert ? to $N
	if database.IsPostgres() {
		where = convertPlaceholders(where)
	}

	// Count
	var total int
	countArgs := make([]interface{}, len(args))
	copy(countArgs, args)
	err := database.DB.QueryRow(`SELECT COUNT(*) FROM audit_log al `+where, countArgs...).Scan(&total)
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{"error": "count failed"})
		return
	}

	// Query with actor name join
	limitOffset := fmt.Sprintf("LIMIT %d OFFSET %d", perPage, offset)
	query := `
		SELECT al.id, al.actor_id, COALESCE(u.username, '') as actor_name,
		       al.action, al.resource_type, al.resource_id,
		       COALESCE(al.metadata, '{}'), al.ip_address, al.created_at
		FROM audit_log al
		LEFT JOIN users u ON al.actor_id = u.id
		` + where + `
		ORDER BY al.created_at DESC
		` + limitOffset

	rows, err := database.DB.Query(query, args...)
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{"error": "query failed"})
		return
	}
	defer rows.Close()

	type entry struct {
		ID           string    `json:"id"`
		ActorID      *string   `json:"actor_id"`
		ActorName    *string   `json:"actor_name"`
		Action       string    `json:"action"`
		ResourceType string    `json:"resource_type"`
		ResourceID   *string   `json:"resource_id"`
		Metadata     string    `json:"metadata"`
		IPAddress    *string   `json:"ip_address"`
		CreatedAt    time.Time `json:"created_at"`
	}

	entries := make([]entry, 0)
	for rows.Next() {
		var e entry
		var actorName sql.NullString
		if err := rows.Scan(&e.ID, &e.ActorID, &actorName, &e.Action,
			&e.ResourceType, &e.ResourceID, &e.Metadata, &e.IPAddress, database.ST(&e.CreatedAt)); err != nil {
			continue
		}
		if actorName.Valid {
			e.ActorName = &actorName.String
		}
		entries = append(entries, e)
	}

	c.JSON(http.StatusOK, gin.H{
		"data":     entries,
		"total":    total,
		"page":     page,
		"per_page": perPage,
	})
}

func (h *TeamHandler) ListTeamAuditActions(c *gin.Context) {
	teamID := c.Param("teamId")

	rows, err := database.DB.Query(database.Q(`
		SELECT DISTINCT al.action
		FROM audit_log al
		WHERE al.actor_id IN (SELECT user_id FROM team_members WHERE team_id = $1)
		ORDER BY al.action ASC
	`), teamID)
	if err != nil {
		c.JSON(http.StatusOK, gin.H{"actions": []string{}})
		return
	}
	defer rows.Close()

	actions := make([]string, 0)
	for rows.Next() {
		var a string
		if rows.Scan(&a) == nil {
			actions = append(actions, a)
		}
	}
	c.JSON(http.StatusOK, gin.H{"actions": actions})
}

// convertPlaceholders converts ? placeholders to $1, $2, etc. for Postgres.
func convertPlaceholders(q string) string {
	n := 1
	var result strings.Builder
	for _, ch := range q {
		if ch == '?' {
			result.WriteString(fmt.Sprintf("$%d", n))
			n++
		} else {
			result.WriteRune(ch)
		}
	}
	return result.String()
}