core/server/handlers/teams.go

package handlers

import (
	"context"
	"database/sql"
	"encoding/json"
	"fmt"
	"log"
	"net/http"
	"strconv"

	"github.com/gin-gonic/gin"

	"git.gobha.me/xcaliber/chat-switchboard/crypto"
	"git.gobha.me/xcaliber/chat-switchboard/database"
	"git.gobha.me/xcaliber/chat-switchboard/models"
	"git.gobha.me/xcaliber/chat-switchboard/providers"
	"git.gobha.me/xcaliber/chat-switchboard/store"
)

// ── Request types ───────────────────────────

type createTeamRequest struct {
	Name        string `json:"name" binding:"required,min=1,max=200"`
	Description string `json:"description,omitempty"`
}

type updateTeamRequest struct {
	Name        *string `json:"name,omitempty"`
	Description *string `json:"description,omitempty"`
	IsActive    *bool   `json:"is_active,omitempty"`
	Settings    *string `json:"settings,omitempty"` // JSON string
}

type addMemberRequest struct {
	UserID string `json:"user_id" binding:"required"`
	Role   string `json:"role" binding:"required,oneof=admin member"`
}

type updateMemberRequest struct {
	Role string `json:"role" binding:"required,oneof=admin member"`
}

// ── Handler ─────────────────────────────────

type TeamHandler struct{
	stores store.Stores
	vault  *crypto.KeyResolver
}

func NewTeamHandler(s store.Stores, vault *crypto.KeyResolver) *TeamHandler {
	return &TeamHandler{stores: s, vault: vault}
}

// ── Admin: List All Teams ───────────────────

func (h *TeamHandler) ListTeams(c *gin.Context) {
	page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
	perPage, _ := strconv.Atoi(c.DefaultQuery("per_page", "50"))
	if page < 1 {
		page = 1
	}
	if perPage < 1 || perPage > 100 {
		perPage = 50
	}

	all, err := h.stores.Teams.List(c.Request.Context())
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{"error": "query failed"})
		return
	}
	if all == nil {
		all = []models.Team{}
	}
	total := len(all)

	// In-memory pagination (teams are low-cardinality)
	offset := (page - 1) * perPage
	end := offset + perPage
	if offset > total {
		offset = total
	}
	if end > total {
		end = total
	}

	c.JSON(http.StatusOK, gin.H{
		"data":     all[offset:end],
		"total":    total,
		"page":     page,
		"per_page": perPage,
	})
}

// ── Admin: Create Team ──────────────────────

func (h *TeamHandler) CreateTeam(c *gin.Context) {
	adminID := getUserID(c)

	var req createTeamRequest
	if err := c.ShouldBindJSON(&req); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
		return
	}

	team := &models.Team{
		Name:        req.Name,
		Description: req.Description,
		CreatedBy:   adminID,
		IsActive:    true,
	}
	if err := h.stores.Teams.Create(c.Request.Context(), team); err != nil {
		if database.IsUniqueViolation(err) {
			c.JSON(http.StatusConflict, gin.H{"error": "team name already exists"})
			return
		}
		c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to create team"})
		return
	}

	c.JSON(http.StatusCreated, gin.H{"id": team.ID, "name": team.Name})
	AuditLog(h.stores.Audit, c, "team.create", "team", team.ID, map[string]interface{}{"name": team.Name})
}

// ── Admin: Get Team ─────────────────────────

func (h *TeamHandler) GetTeam(c *gin.Context) {
	teamID := c.Param("id")

	team, err := h.stores.Teams.GetByID(c.Request.Context(), teamID)
	if err == sql.ErrNoRows {
		c.JSON(http.StatusNotFound, gin.H{"error": "team not found"})
		return
	}
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{"error": "query failed"})
		return
	}

	c.JSON(http.StatusOK, team)
}

// ── Admin: Update Team ──────────────────────

func (h *TeamHandler) UpdateTeam(c *gin.Context) {
	teamID := c.Param("id")

	var req updateTeamRequest
	if err := c.ShouldBindJSON(&req); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
		return
	}

	// Build fields map for store.Update (simple scalar fields)
	fields := map[string]interface{}{}
	if req.Name != nil {
		fields["name"] = *req.Name
	}
	if req.Description != nil {
		fields["description"] = *req.Description
	}
	if req.IsActive != nil {
		fields["is_active"] = *req.IsActive
	}

	hasFields := len(fields) > 0
	hasSettings := req.Settings != nil

	if !hasFields && !hasSettings {
		c.JSON(http.StatusBadRequest, gin.H{"error": "no fields to update"})
		return
	}

	ctx := c.Request.Context()

	if hasFields {
		if err := h.stores.Teams.Update(ctx, teamID, fields); err != nil {
			if database.IsUniqueViolation(err) {
				c.JSON(http.StatusConflict, gin.H{"error": "team name already exists"})
				return
			}
			c.JSON(http.StatusInternalServerError, gin.H{"error": "update failed"})
			return
		}
	}

	if hasSettings {
		if err := h.stores.Teams.MergeSettings(ctx, teamID, *req.Settings); err != nil {
			c.JSON(http.StatusInternalServerError, gin.H{"error": "settings update failed"})
			return
		}
	}

	c.JSON(http.StatusOK, gin.H{"ok": true})
	AuditLog(h.stores.Audit, c, "team.update", "team", teamID, nil)
}

// ── Admin: Delete Team ──────────────────────

func (h *TeamHandler) DeleteTeam(c *gin.Context) {
	teamID := c.Param("id")
	ctx := c.Request.Context()

	// Verify existence
	if _, err := h.stores.Teams.GetByID(ctx, teamID); err != nil {
		if err == sql.ErrNoRows {
			c.JSON(http.StatusNotFound, gin.H{"error": "team not found"})
			return
		}
		c.JSON(http.StatusInternalServerError, gin.H{"error": "delete failed"})
		return
	}

	if err := h.stores.Teams.Delete(ctx, teamID); err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{"error": "delete failed"})
		return
	}

	c.JSON(http.StatusOK, gin.H{"ok": true})
	AuditLog(h.stores.Audit, c, "team.delete", "team", teamID, nil)
}

// ── Members: List ───────────────────────────

func (h *TeamHandler) ListMembers(c *gin.Context) {
	teamID := getTeamID(c)

	members, err := h.stores.Teams.ListMembers(c.Request.Context(), teamID)
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{"error": "query failed"})
		return
	}
	if members == nil {
		members = []models.TeamMember{}
	}

	c.JSON(http.StatusOK, gin.H{"data": members})
}

// ── Members: Add ────────────────────────────

func (h *TeamHandler) AddMember(c *gin.Context) {
	teamID := getTeamID(c)
	ctx := c.Request.Context()

	var req addMemberRequest
	if err := c.ShouldBindJSON(&req); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
		return
	}

	// Verify team exists
	exists, _ := h.stores.Teams.Exists(ctx, teamID)
	if !exists {
		c.JSON(http.StatusNotFound, gin.H{"error": "team not found"})
		return
	}

	// Verify user exists
	userExists, _ := h.stores.Users.Exists(ctx, req.UserID)
	if !userExists {
		c.JSON(http.StatusBadRequest, gin.H{"error": "user not found"})
		return
	}

	id, err := h.stores.Teams.AddMemberReturningID(ctx, teamID, req.UserID, req.Role)
	if err != nil {
		if database.IsUniqueViolation(err) {
			c.JSON(http.StatusConflict, gin.H{"error": "user is already a member"})
			return
		}
		c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to add member"})
		return
	}

	c.JSON(http.StatusCreated, gin.H{"id": id})
	AuditLog(h.stores.Audit, c, "team.add_member", "team", getTeamID(c), map[string]interface{}{
		"user_id": req.UserID, "role": req.Role,
	})
}

// ── Members: Update Role ────────────────────

func (h *TeamHandler) UpdateMember(c *gin.Context) {
	teamID := getTeamID(c)
	memberID := c.Param("memberId")

	var req updateMemberRequest
	if err := c.ShouldBindJSON(&req); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
		return
	}

	n, err := h.stores.Teams.UpdateMemberRoleByID(c.Request.Context(), memberID, teamID, req.Role)
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{"error": "update failed"})
		return
	}
	if n == 0 {
		c.JSON(http.StatusNotFound, gin.H{"error": "member not found"})
		return
	}

	c.JSON(http.StatusOK, gin.H{"ok": true})
	AuditLog(h.stores.Audit, c, "team.update_member", "team", getTeamID(c), map[string]interface{}{
		"member_id": memberID, "role": req.Role,
	})
}

// ── Members: Remove ─────────────────────────

func (h *TeamHandler) RemoveMember(c *gin.Context) {
	teamID := getTeamID(c)
	memberID := c.Param("memberId")

	n, err := h.stores.Teams.DeleteMemberByID(c.Request.Context(), memberID, teamID)
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{"error": "remove failed"})
		return
	}
	if n == 0 {
		c.JSON(http.StatusNotFound, gin.H{"error": "member not found"})
		return
	}

	c.JSON(http.StatusOK, gin.H{"ok": true})
	AuditLog(h.stores.Audit, c, "team.remove_member", "team", getTeamID(c), map[string]interface{}{
		"member_id": memberID,
	})
}

// ── User: My Teams ──────────────────────────

func (h *TeamHandler) MyTeams(c *gin.Context) {
	userID := getUserID(c)

	teams, err := h.stores.Teams.ListForUser(c.Request.Context(), userID)
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{"error": "query failed"})
		return
	}
	if teams == nil {
		teams = []models.Team{}
	}

	c.JSON(http.StatusOK, gin.H{"data": teams})
}

// ── Team Models: Available for Personas ──────

// ListAvailableModels returns models with visibility 'enabled' or 'team'
// for team admins building personas. Requires RequireTeamAdmin middleware.
// GET /api/v1/teams/:teamId/models
func (h *TeamHandler) ListAvailableModels(c *gin.Context) {
	teamID := getTeamID(c)
	ctx := c.Request.Context()

	type availableModel struct {
		ID           string  `json:"id"`
		ModelID      string  `json:"model_id"`
		DisplayName  *string `json:"display_name"`
		Visibility   string  `json:"visibility"`
		Provider     string  `json:"provider"`
		ProviderName string  `json:"provider_name"`
		Source       string  `json:"source"`
	}

	result := make([]availableModel, 0)

	// ── 1. Global admin models (synced in model_catalog) ──
	catalogModels, err := h.stores.Catalog.ListTeamAvailable(ctx)
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{"error": "query failed"})
		return
	}
	for _, cm := range catalogModels {
		result = append(result, availableModel{
			ID:           cm.ID,
			ModelID:      cm.ModelID,
			DisplayName:  cm.DisplayName,
			Visibility:   cm.Visibility,
			Provider:     cm.Provider,
			ProviderName: cm.ProviderName,
			Source:       "global",
		})
	}

	// ── 2. Team provider models (live query) ──
	teamConfigs, err := h.stores.Providers.ListForTeam(ctx, teamID)
	if err == nil {
		for _, cfg := range teamConfigs {
			provider, pErr := providers.Get(cfg.Provider)
			if pErr != nil {
				continue
			}

			key := ""
			if cfg.HasKey() {
				key = string(cfg.APIKeyEnc)
			}

			var customHeaders map[string]string
			if cfg.Headers != nil {
				b, _ := json.Marshal(cfg.Headers)
				_ = json.Unmarshal(b, &customHeaders)
			}

			provModels, lErr := provider.ListModels(ctx, providers.ProviderConfig{
				Endpoint:      cfg.Endpoint,
				APIKey:        key,
				CustomHeaders: customHeaders,
			})
			if lErr != nil {
				log.Printf("[models] team provider %q list failed: %v", cfg.Name, lErr)
				continue
			}

			for _, pm := range provModels {
				result = append(result, availableModel{
					ID:           pm.ID,
					ModelID:      pm.ID,
					Provider:     cfg.Provider,
					ProviderName: cfg.Name,
					Visibility:   "enabled",
					Source:       "team",
				})
			}
		}
	}

	c.JSON(http.StatusOK, gin.H{"models": result})
}

// ── Helpers ─────────────────────────────────

// getTeamID extracts team ID from either :id (admin routes) or :teamId (team-scoped routes).
func getTeamID(c *gin.Context) string {
	if id := c.Param("teamId"); id != "" {
		return id
	}
	return c.Param("id")
}

// enforcePrivateProviderPolicy checks if a user belongs to any team that
// requires private providers, and if so, verifies the resolved config is
// marked as private. Returns nil if allowed, error if blocked.
func enforcePrivateProviderPolicy(ctx context.Context, stores store.Stores, userID, configID string) error {
	if configID == "" {
		return nil
	}

	requiresPrivate, err := stores.Teams.HasPrivateProviderRequirement(ctx, userID)
	if err != nil || !requiresPrivate {
		return nil
	}

	// User is in a restricted team — verify the config is private
	cfg, err := stores.Providers.GetByID(ctx, configID)
	if err != nil {
		return nil // config lookup failed, allow (fail open)
	}
	if !cfg.IsPrivate {
		return fmt.Errorf("your team requires private providers — this provider sends data externally")
	}
	return nil
}

// ── Team Audit Log (scoped to team members) ─

func (h *TeamHandler) ListTeamAuditLog(c *gin.Context) {
	teamID := c.Param("teamId")
	page, perPage, offset := parsePagination(c)

	opts := store.AuditListOptions{
		ListOptions: store.ListOptions{
			Limit:  perPage,
			Offset: offset,
		},
		TeamID: teamID,
	}

	if action := c.Query("action"); action != "" {
		opts.Action = action
	}
	if actorID := c.Query("actor_id"); actorID != "" {
		opts.ActorID = actorID
	}
	if rt := c.Query("resource_type"); rt != "" {
		opts.ResourceType = rt
	}

	entries, total, err := h.stores.Audit.List(c.Request.Context(), opts)
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{"error": "query failed"})
		return
	}
	if entries == nil {
		entries = []models.AuditEntry{}
	}

	c.JSON(http.StatusOK, gin.H{
		"data":     entries,
		"total":    total,
		"page":     page,
		"per_page": perPage,
	})
}

func (h *TeamHandler) ListTeamAuditActions(c *gin.Context) {
	teamID := c.Param("teamId")

	actions, err := h.stores.Teams.ListTeamAuditActions(c.Request.Context(), teamID)
	if err != nil {
		c.JSON(http.StatusOK, gin.H{"actions": []string{}})
		return
	}

	c.JSON(http.StatusOK, gin.H{"actions": actions})
}