import { NextAuthOptions } from 'next-auth';
import KeycloakProvider from 'next-auth/providers/keycloak';
import CredentialsProvider from 'next-auth/providers/credentials';

// Check if Keycloak is configured
const isKeycloakConfigured = 
  process.env.KEYCLOAK_URL && 
  process.env.KEYCLOAK_CLIENT_ID && 
  process.env.KEYCLOAK_CLIENT_SECRET;

const providers = [];

// Add Keycloak provider if configured
if (isKeycloakConfigured) {
  providers.push(
    KeycloakProvider({
      clientId: process.env.KEYCLOAK_CLIENT_ID!,
      clientSecret: process.env.KEYCLOAK_CLIENT_SECRET!,
      issuer: `${process.env.KEYCLOAK_URL}/realms/${process.env.KEYCLOAK_REALM || 'master'}`,
    })
  );
} else {
  // Development mode: Use credentials provider
  providers.push(
    CredentialsProvider({
      name: 'Credentials',
      credentials: {
        email: { label: 'Email', type: 'email', placeholder: 'dev@example.com' },
        password: { label: 'Password', type: 'password' },
      },
      async authorize(credentials) {
        // In development, accept any credentials
        if (process.env.NODE_ENV === 'development') {
          return {
            id: 'dev-user',
            email: credentials?.email || 'dev@example.com',
            name: 'Development User',
            role: 'ADMIN',
          };
        }
        return null;
      },
    })
  );
}

export const authOptions: NextAuthOptions = {
  providers,
  callbacks: {
    async redirect({ url, baseUrl }) {
      // Prevent redirect loops - only allow redirects within the same origin
      if (url.startsWith('/')) return `${baseUrl}${url}`;
      if (new URL(url).origin === baseUrl) return url;
      return baseUrl;
    },
    async jwt({ token, account, profile, user }) {
      if (account) {
        token.accessToken = account.access_token;
        token.refreshToken = account.refresh_token;
        token.idToken = account.id_token;
      }
      
      // For credentials provider, add user info
      if (user) {
        token.id = user.id;
        token.email = user.email;
        token.name = user.name;
      }
      
      // Extract roles from Keycloak token
      if (profile && 'realm_access' in profile) {
        const realmAccess = profile.realm_access as { roles?: string[] };
        token.roles = realmAccess.roles || [];
      }
      
      return token;
    },
    async session({ session, token }) {
      if (token) {
        session.accessToken = token.accessToken as string;
        session.roles = token.roles as string[];
        if (token.id) {
          session.user = {
            ...session.user,
            id: token.id as string,
            email: token.email as string,
            name: token.name as string,
          };
        }
      }
      return session;
    },
  },
  pages: {
    signIn: '/api/auth/signin',
    error: '/api/auth/error',
  },
  session: {
    strategy: 'jwt',
    maxAge: 24 * 60 * 60, // 24 hours
  },
};
