core/server/handlers/teams.go

package handlers

import (
	"database/sql"
	"encoding/json"
	"fmt"
	"log"
	"net/http"
	"strconv"
	"strings"

	"github.com/gin-gonic/gin"

	"git.gobha.me/xcaliber/chat-switchboard/database"
	"git.gobha.me/xcaliber/chat-switchboard/providers"
)

// ── Request types ───────────────────────────

type createTeamRequest struct {
	Name        string `json:"name" binding:"required,min=1,max=200"`
	Description string `json:"description,omitempty"`
}

type updateTeamRequest struct {
	Name        *string `json:"name,omitempty"`
	Description *string `json:"description,omitempty"`
	IsActive    *bool   `json:"is_active,omitempty"`
	Settings    *string `json:"settings,omitempty"` // JSON string
}

type addMemberRequest struct {
	UserID string `json:"user_id" binding:"required"`
	Role   string `json:"role" binding:"required,oneof=admin member"`
}

type updateMemberRequest struct {
	Role string `json:"role" binding:"required,oneof=admin member"`
}

// ── Handler ─────────────────────────────────

type TeamHandler struct{}

func NewTeamHandler() *TeamHandler { return &TeamHandler{} }

// ── Admin: List All Teams ───────────────────

func (h *TeamHandler) ListTeams(c *gin.Context) {
	page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
	perPage, _ := strconv.Atoi(c.DefaultQuery("per_page", "50"))
	if page < 1 {
		page = 1
	}
	if perPage < 1 || perPage > 100 {
		perPage = 50
	}
	offset := (page - 1) * perPage

	var total int
	if err := database.DB.QueryRow(`SELECT COUNT(*) FROM teams`).Scan(&total); err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to count teams"})
		return
	}

	rows, err := database.DB.Query(`
		SELECT t.id, t.name, t.description, t.created_by, t.is_active,
		       COALESCE(t.settings::text, '{}'), t.created_at, t.updated_at,
		       COALESCE(mc.cnt, 0) AS member_count
		FROM teams t
		LEFT JOIN (
			SELECT team_id, COUNT(*) AS cnt FROM team_members GROUP BY team_id
		) mc ON mc.team_id = t.id
		ORDER BY t.name ASC
		LIMIT $1 OFFSET $2
	`, perPage, offset)
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{"error": "query failed"})
		return
	}
	defer rows.Close()

	var teams []gin.H
	for rows.Next() {
		var id, name, desc, createdBy, settings string
		var isActive bool
		var memberCount int
		var createdAt, updatedAt sql.NullTime
		if err := rows.Scan(&id, &name, &desc, &createdBy, &isActive, &settings,
			&createdAt, &updatedAt, &memberCount); err != nil {
			continue
		}
		teams = append(teams, gin.H{
			"id":           id,
			"name":         name,
			"description":  desc,
			"created_by":   createdBy,
			"is_active":    isActive,
			"settings":     settings,
			"member_count": memberCount,
			"created_at":   createdAt.Time,
			"updated_at":   updatedAt.Time,
		})
	}
	if teams == nil {
		teams = []gin.H{}
	}

	c.JSON(http.StatusOK, gin.H{
		"data":     teams,
		"total":    total,
		"page":     page,
		"per_page": perPage,
	})
}

// ── Admin: Create Team ──────────────────────

func (h *TeamHandler) CreateTeam(c *gin.Context) {
	adminID := getUserID(c)

	var req createTeamRequest
	if err := c.ShouldBindJSON(&req); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
		return
	}

	var id string
	err := database.DB.QueryRow(`
		INSERT INTO teams (name, description, created_by)
		VALUES ($1, $2, $3)
		RETURNING id
	`, req.Name, req.Description, adminID).Scan(&id)
	if err != nil {
		if isUniqueViolation(err) {
			c.JSON(http.StatusConflict, gin.H{"error": "team name already exists"})
			return
		}
		c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to create team"})
		return
	}

	c.JSON(http.StatusCreated, gin.H{"id": id, "name": req.Name})
	AuditLog(c, "team.create", "team", id, map[string]interface{}{"name": req.Name})
}

// ── Admin: Get Team ─────────────────────────

func (h *TeamHandler) GetTeam(c *gin.Context) {
	teamID := c.Param("id")

	var name, desc, createdBy, settings string
	var isActive bool
	var memberCount int
	var createdAt, updatedAt sql.NullTime

	err := database.DB.QueryRow(`
		SELECT t.name, t.description, t.created_by, t.is_active,
		       COALESCE(t.settings::text, '{}'), t.created_at, t.updated_at,
		       (SELECT COUNT(*) FROM team_members WHERE team_id = t.id)
		FROM teams t WHERE t.id = $1
	`, teamID).Scan(&name, &desc, &createdBy, &isActive, &settings,
		&createdAt, &updatedAt, &memberCount)
	if err == sql.ErrNoRows {
		c.JSON(http.StatusNotFound, gin.H{"error": "team not found"})
		return
	}
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{"error": "query failed"})
		return
	}

	c.JSON(http.StatusOK, gin.H{
		"id":           teamID,
		"name":         name,
		"description":  desc,
		"created_by":   createdBy,
		"is_active":    isActive,
		"settings":     settings,
		"member_count": memberCount,
		"created_at":   createdAt.Time,
		"updated_at":   updatedAt.Time,
	})
}

// ── Admin: Update Team ──────────────────────

func (h *TeamHandler) UpdateTeam(c *gin.Context) {
	teamID := c.Param("id")

	var req updateTeamRequest
	if err := c.ShouldBindJSON(&req); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
		return
	}

	// Build dynamic update
	sets := []string{}
	args := []interface{}{}
	argN := 1

	if req.Name != nil {
		sets = append(sets, "name = $"+strconv.Itoa(argN))
		args = append(args, *req.Name)
		argN++
	}
	if req.Description != nil {
		sets = append(sets, "description = $"+strconv.Itoa(argN))
		args = append(args, *req.Description)
		argN++
	}
	if req.IsActive != nil {
		sets = append(sets, "is_active = $"+strconv.Itoa(argN))
		args = append(args, *req.IsActive)
		argN++
	}
	if req.Settings != nil {
		sets = append(sets, "settings = COALESCE(settings, '{}'::jsonb) || $"+strconv.Itoa(argN)+"::jsonb")
		args = append(args, *req.Settings)
		argN++
	}

	if len(sets) == 0 {
		c.JSON(http.StatusBadRequest, gin.H{"error": "no fields to update"})
		return
	}

	query := "UPDATE teams SET "
	for i, s := range sets {
		if i > 0 {
			query += ", "
		}
		query += s
	}
	query += " WHERE id = $" + strconv.Itoa(argN)
	args = append(args, teamID)

	res, err := database.DB.Exec(query, args...)
	if err != nil {
		if isUniqueViolation(err) {
			c.JSON(http.StatusConflict, gin.H{"error": "team name already exists"})
			return
		}
		c.JSON(http.StatusInternalServerError, gin.H{"error": "update failed"})
		return
	}
	if n, _ := res.RowsAffected(); n == 0 {
		c.JSON(http.StatusNotFound, gin.H{"error": "team not found"})
		return
	}

	c.JSON(http.StatusOK, gin.H{"ok": true})
	AuditLog(c, "team.update", "team", teamID, nil)
}

// ── Admin: Delete Team ──────────────────────

func (h *TeamHandler) DeleteTeam(c *gin.Context) {
	teamID := c.Param("id")

	res, err := database.DB.Exec(`DELETE FROM teams WHERE id = $1`, teamID)
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{"error": "delete failed"})
		return
	}
	if n, _ := res.RowsAffected(); n == 0 {
		c.JSON(http.StatusNotFound, gin.H{"error": "team not found"})
		return
	}

	c.JSON(http.StatusOK, gin.H{"ok": true})
	AuditLog(c, "team.delete", "team", teamID, nil)
}

// ── Members: List ───────────────────────────

func (h *TeamHandler) ListMembers(c *gin.Context) {
	teamID := getTeamID(c)

	rows, err := database.DB.Query(`
		SELECT tm.id, tm.user_id, tm.role, tm.joined_at,
		       u.email, COALESCE(u.display_name, '') AS display_name, u.role AS user_role
		FROM team_members tm
		JOIN users u ON u.id = tm.user_id
		WHERE tm.team_id = $1
		ORDER BY tm.role ASC, u.email ASC
	`, teamID)
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{"error": "query failed"})
		return
	}
	defer rows.Close()

	var members []gin.H
	for rows.Next() {
		var id, userID, role, email, displayName, userRole string
		var joinedAt sql.NullTime
		if err := rows.Scan(&id, &userID, &role, &joinedAt, &email, &displayName, &userRole); err != nil {
			continue
		}
		members = append(members, gin.H{
			"id":           id,
			"user_id":      userID,
			"role":         role,
			"joined_at":    joinedAt.Time,
			"email":        email,
			"display_name": displayName,
			"user_role":    userRole,
		})
	}
	if members == nil {
		members = []gin.H{}
	}

	c.JSON(http.StatusOK, gin.H{"data": members})
}

// ── Members: Add ────────────────────────────

func (h *TeamHandler) AddMember(c *gin.Context) {
	teamID := getTeamID(c)

	var req addMemberRequest
	if err := c.ShouldBindJSON(&req); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
		return
	}

	// Verify team exists
	var exists bool
	database.DB.QueryRow(`SELECT EXISTS(SELECT 1 FROM teams WHERE id = $1)`, teamID).Scan(&exists)
	if !exists {
		c.JSON(http.StatusNotFound, gin.H{"error": "team not found"})
		return
	}

	// Verify user exists
	database.DB.QueryRow(`SELECT EXISTS(SELECT 1 FROM users WHERE id = $1)`, req.UserID).Scan(&exists)
	if !exists {
		c.JSON(http.StatusBadRequest, gin.H{"error": "user not found"})
		return
	}

	var id string
	err := database.DB.QueryRow(`
		INSERT INTO team_members (team_id, user_id, role)
		VALUES ($1, $2, $3)
		RETURNING id
	`, teamID, req.UserID, req.Role).Scan(&id)
	if err != nil {
		if isUniqueViolation(err) {
			c.JSON(http.StatusConflict, gin.H{"error": "user is already a member"})
			return
		}
		c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to add member"})
		return
	}

	c.JSON(http.StatusCreated, gin.H{"id": id})
	AuditLog(c, "team.add_member", "team", getTeamID(c), map[string]interface{}{
		"user_id": req.UserID, "role": req.Role,
	})
}

// ── Members: Update Role ────────────────────

func (h *TeamHandler) UpdateMember(c *gin.Context) {
	memberID := c.Param("memberId")

	var req updateMemberRequest
	if err := c.ShouldBindJSON(&req); err != nil {
		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
		return
	}

	res, err := database.DB.Exec(`
		UPDATE team_members SET role = $1 WHERE id = $2
	`, req.Role, memberID)
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{"error": "update failed"})
		return
	}
	if n, _ := res.RowsAffected(); n == 0 {
		c.JSON(http.StatusNotFound, gin.H{"error": "member not found"})
		return
	}

	c.JSON(http.StatusOK, gin.H{"ok": true})
	AuditLog(c, "team.update_member", "team", getTeamID(c), map[string]interface{}{
		"member_id": memberID, "role": req.Role,
	})
}

// ── Members: Remove ─────────────────────────

func (h *TeamHandler) RemoveMember(c *gin.Context) {
	memberID := c.Param("memberId")

	res, err := database.DB.Exec(`DELETE FROM team_members WHERE id = $1`, memberID)
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{"error": "remove failed"})
		return
	}
	if n, _ := res.RowsAffected(); n == 0 {
		c.JSON(http.StatusNotFound, gin.H{"error": "member not found"})
		return
	}

	c.JSON(http.StatusOK, gin.H{"ok": true})
	AuditLog(c, "team.remove_member", "team", getTeamID(c), map[string]interface{}{
		"member_id": memberID,
	})
}

// ── User: My Teams ──────────────────────────

func (h *TeamHandler) MyTeams(c *gin.Context) {
	userID := getUserID(c)

	rows, err := database.DB.Query(`
		SELECT t.id, t.name, t.description, t.is_active,
		       COALESCE(t.settings::text, '{}'),
		       tm.role AS my_role,
		       (SELECT COUNT(*) FROM team_members WHERE team_id = t.id) AS member_count
		FROM teams t
		JOIN team_members tm ON tm.team_id = t.id AND tm.user_id = $1
		WHERE t.is_active = true
		ORDER BY t.name ASC
	`, userID)
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{"error": "query failed"})
		return
	}
	defer rows.Close()

	var teams []gin.H
	for rows.Next() {
		var id, name, desc, settings, myRole string
		var isActive bool
		var memberCount int
		if err := rows.Scan(&id, &name, &desc, &isActive, &settings, &myRole, &memberCount); err != nil {
			continue
		}
		teams = append(teams, gin.H{
			"id":           id,
			"name":         name,
			"description":  desc,
			"is_active":    isActive,
			"settings":     settings,
			"my_role":      myRole,
			"member_count": memberCount,
		})
	}
	if teams == nil {
		teams = []gin.H{}
	}

	c.JSON(http.StatusOK, gin.H{"data": teams})
}

// ── Team Models: Available for Presets ──────

// ListAvailableModels returns models with visibility 'enabled' or 'team'
// for team admins building presets. Requires RequireTeamAdmin middleware.
// GET /api/v1/teams/:teamId/models
func (h *TeamHandler) ListAvailableModels(c *gin.Context) {
	teamID := getTeamID(c)

	type availableModel struct {
		ID           string  `json:"id"`
		ModelID      string  `json:"model_id"`
		DisplayName  *string `json:"display_name"`
		Visibility   string  `json:"visibility"`
		Provider     string  `json:"provider"`
		ProviderName string  `json:"provider_name"`
		Source       string  `json:"source"`
	}

	models := make([]availableModel, 0)

	// ── 1. Global admin models (synced in model_catalog) ──
	rows, err := database.DB.Query(`
		SELECT mc.id, mc.model_id, mc.display_name, mc.visibility,
		       ac.provider, ac.name as provider_name
		FROM model_catalog mc
		JOIN provider_configs ac ON mc.provider_config_id = ac.id
		WHERE mc.visibility IN ('enabled', 'team')
		  AND ac.is_active = true AND ac.scope = 'global'
		ORDER BY ac.name, mc.model_id
	`)
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{"error": "query failed"})
		return
	}
	defer rows.Close()

	for rows.Next() {
		var m availableModel
		if err := rows.Scan(&m.ID, &m.ModelID, &m.DisplayName, &m.Visibility,
			&m.Provider, &m.ProviderName); err != nil {
			continue
		}
		m.Source = "global"
		models = append(models, m)
	}

	// ── 2. Team provider models (live query) ──
	teamRows, err := database.DB.Query(`
		SELECT id, name, provider, endpoint, api_key_enc, headers
		FROM provider_configs
		WHERE scope = 'team' AND owner_id = $1 AND is_active = true
	`, teamID)
	if err == nil {
		defer teamRows.Close()
		for teamRows.Next() {
			var cfgID, name, providerID, endpoint string
			var apiKey *string
			var headersJSON []byte
			if err := teamRows.Scan(&cfgID, &name, &providerID, &endpoint, &apiKey, &headersJSON); err != nil {
				continue
			}

			provider, pErr := providers.Get(providerID)
			if pErr != nil {
				continue
			}

			key := ""
			if apiKey != nil {
				key = *apiKey
			}

			var customHeaders map[string]string
			_ = json.Unmarshal(headersJSON, &customHeaders)

			provModels, lErr := provider.ListModels(c.Request.Context(), providers.ProviderConfig{
				Endpoint:      endpoint,
				APIKey:        key,
				CustomHeaders: customHeaders,
			})
			if lErr != nil {
				log.Printf("[models] team provider %q list failed: %v", name, lErr)
				continue
			}

			for _, pm := range provModels {
				models = append(models, availableModel{
					ID:           pm.ID,
					ModelID:      pm.ID,
					Provider:     providerID,
					ProviderName: name,
					Visibility:   "enabled",
					Source:       "team",
				})
			}
		}
	}

	c.JSON(http.StatusOK, gin.H{"models": models})
}

// ── Helpers ─────────────────────────────────

// getTeamID extracts team ID from either :id (admin routes) or :teamId (team-scoped routes).
func getTeamID(c *gin.Context) string {
	if id := c.Param("teamId"); id != "" {
		return id
	}
	return c.Param("id")
}

// isUniqueViolation checks if a PG error is a unique constraint violation.
func isUniqueViolation(err error) bool {
	if err == nil {
		return false
	}
	return strings.Contains(err.Error(), "duplicate key")
}

// IsTeamAdmin checks if a user is an admin of the given team.
func IsTeamAdmin(userID, teamID string) bool {
	var role string
	err := database.DB.QueryRow(`
		SELECT role FROM team_members WHERE team_id = $1 AND user_id = $2
	`, teamID, userID).Scan(&role)
	return err == nil && role == "admin"
}

// IsTeamMember checks if a user belongs to the given team (any role).
func IsTeamMember(userID, teamID string) bool {
	var exists bool
	database.DB.QueryRow(`
		SELECT EXISTS(SELECT 1 FROM team_members WHERE team_id = $1 AND user_id = $2)
	`, teamID, userID).Scan(&exists)
	return exists
}

// enforcePrivateProviderPolicy checks if a user belongs to any team that
// requires private providers, and if so, verifies the resolved config is
// marked as private. Returns nil if allowed, error if blocked.
func enforcePrivateProviderPolicy(userID, configID string) error {
	if configID == "" {
		return nil
	}

	// Check if user belongs to any team with require_private_providers policy
	var requiresPrivate bool
	err := database.DB.QueryRow(`
		SELECT EXISTS(
			SELECT 1 FROM team_members tm
			JOIN teams t ON t.id = tm.team_id
			WHERE tm.user_id = $1
			  AND t.is_active = true
			  AND t.settings->>'require_private_providers' = 'true'
		)
	`, userID).Scan(&requiresPrivate)
	if err != nil || !requiresPrivate {
		return nil
	}

	// User is in a restricted team — verify the config is private
	var isPrivate bool
	err = database.DB.QueryRow(`
		SELECT COALESCE(is_private, false) FROM provider_configs WHERE id = $1
	`, configID).Scan(&isPrivate)
	if err != nil {
		return nil // config lookup failed, allow (fail open)
	}
	if !isPrivate {
		return fmt.Errorf("your team requires private providers — this provider sends data externally")
	}
	return nil
}

// ── Team Audit Log (scoped to team members) ─

// ListTeamAuditLog returns paginated audit entries where the actor is a member
// of the specified team. Team admins see only their team's activity; system
// admins see everything (but the scoping still applies via the same query).
// GET /api/v1/teams/:teamId/audit?page=1&per_page=50&action=...&actor_id=...&resource_type=...
func (h *TeamHandler) ListTeamAuditLog(c *gin.Context) {
	teamID := c.Param("teamId")
	page, perPage, offset := parsePagination(c)

	// Build filter clauses — always scoped to team members
	where := "WHERE al.actor_id IN (SELECT user_id FROM team_members WHERE team_id = $1)"
	args := []interface{}{teamID}
	argN := 2

	if action := c.Query("action"); action != "" {
		where += " AND al.action = $" + strconv.Itoa(argN)
		args = append(args, action)
		argN++
	}
	if actorID := c.Query("actor_id"); actorID != "" {
		where += " AND al.actor_id = $" + strconv.Itoa(argN)
		args = append(args, actorID)
		argN++
	}
	if rt := c.Query("resource_type"); rt != "" {
		where += " AND al.resource_type = $" + strconv.Itoa(argN)
		args = append(args, rt)
		argN++
	}

	// Count
	var total int
	countArgs := make([]interface{}, len(args))
	copy(countArgs, args)
	err := database.DB.QueryRow(`SELECT COUNT(*) FROM audit_log al `+where, countArgs...).Scan(&total)
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{"error": "count failed"})
		return
	}

	// Query with actor name join
	query := `
		SELECT al.id, al.actor_id, COALESCE(u.username, '') as actor_name,
		       al.action, al.resource_type, al.resource_id,
		       COALESCE(al.metadata::text, '{}'), al.ip_address, al.created_at
		FROM audit_log al
		LEFT JOIN users u ON al.actor_id = u.id
		` + where + `
		ORDER BY al.created_at DESC
		LIMIT $` + strconv.Itoa(argN) + ` OFFSET $` + strconv.Itoa(argN+1)
	args = append(args, perPage, offset)

	rows, err := database.DB.Query(query, args...)
	if err != nil {
		c.JSON(http.StatusInternalServerError, gin.H{"error": "query failed"})
		return
	}
	defer rows.Close()

	type entry struct {
		ID           string  `json:"id"`
		ActorID      *string `json:"actor_id"`
		ActorName    *string `json:"actor_name"`
		Action       string  `json:"action"`
		ResourceType string  `json:"resource_type"`
		ResourceID   *string `json:"resource_id"`
		Metadata     string  `json:"metadata"`
		IPAddress    *string `json:"ip_address"`
		CreatedAt    string  `json:"created_at"`
	}

	entries := make([]entry, 0)
	for rows.Next() {
		var e entry
		var actorName sql.NullString
		if err := rows.Scan(&e.ID, &e.ActorID, &actorName, &e.Action,
			&e.ResourceType, &e.ResourceID, &e.Metadata, &e.IPAddress, &e.CreatedAt); err != nil {
			continue
		}
		if actorName.Valid {
			e.ActorName = &actorName.String
		}
		entries = append(entries, e)
	}

	c.JSON(http.StatusOK, gin.H{
		"data":     entries,
		"total":    total,
		"page":     page,
		"per_page": perPage,
	})
}

// ListTeamAuditActions returns distinct action names for audit entries within
// the team scope, for filter dropdowns.
// GET /api/v1/teams/:teamId/audit/actions
func (h *TeamHandler) ListTeamAuditActions(c *gin.Context) {
	teamID := c.Param("teamId")

	rows, err := database.DB.Query(`
		SELECT DISTINCT al.action
		FROM audit_log al
		WHERE al.actor_id IN (SELECT user_id FROM team_members WHERE team_id = $1)
		ORDER BY al.action ASC
	`, teamID)
	if err != nil {
		c.JSON(http.StatusOK, gin.H{"actions": []string{}})
		return
	}
	defer rows.Close()

	actions := make([]string, 0)
	for rows.Next() {
		var a string
		if rows.Scan(&a) == nil {
			actions = append(actions, a)
		}
	}
	c.JSON(http.StatusOK, gin.H{"actions": actions})
}