import { Injectable } from '@angular/core';
import { Router } from '@angular/router';
import { jwtDecode } from 'jwt-decode';

export type UserCategory =
  | 'super-admin'
  | 'ou-admin'
  | 'ou-operator'
  | 'ou-minimal'
  | 'user';

interface JwtPayload {
  roles: string[];
  username: string;
  id: number;
  uuid: string;
  groupsView: string;
  clientsPerPage: number | null;
}

@Injectable({ providedIn: 'root' })
export class AuthService {
  private tokenPayload: JwtPayload | null = null;

  constructor(private router: Router) {
    this.loadToken();
  }

  /** Intenta leer y decodificar el token de localStorage */
  private loadToken() {
    const token = localStorage.getItem('loginToken');
    if (!token) return;
    try {
      this.tokenPayload = jwtDecode<JwtPayload>(token);
    } catch (e) {
      console.error('Error decoding JWT', e);
      this.tokenPayload = null;
    }
  }

  /** Fuerza recarga del token (por si cambió en localStorage) */
  public refresh() {
    this.loadToken();
  }

  /** Roles básicos que aparecen en el token */
  private get roles(): string[] {
    return this.tokenPayload?.roles || [];
  }

  get isSuperAdmin(): boolean {
    return this.roles.includes('ROLE_SUPER_ADMIN');
  }

  get isOUAdmin(): boolean {
    return this.roles.includes('ROLE_ORGANIZATIONAL_UNIT_ADMIN');
  }

  get isOUOperator(): boolean {
    return this.roles.includes('ROLE_ORGANIZATIONAL_UNIT_OPERATOR');
  }

  get isOUMinimal(): boolean {
    return this.roles.includes('ROLE_ORGANIZATIONAL_UNIT_MINIMAL');
  }

  /**
   * Categoría única de usuario, según prioridades:
   * - super-admin
   * - ou-admin
   * - ou-operator
   * - ou-minimal
   * - user (fallback)
   */
  get userCategory(): UserCategory {
    if (this.isSuperAdmin) return 'super-admin';
    if (this.isOUAdmin) return 'ou-admin';
    if (this.isOUOperator) return 'ou-operator';
    if (this.isOUMinimal) return 'ou-minimal';
    return 'user';
  }

  /** Nombre de usuario */
  get username(): string | null {
    return this.tokenPayload?.username || null;
  }

  /** Uuid del usuario*/
  get uuid(): any | null {
    return this.tokenPayload?.uuid || null;
  }

  /** groupsView del usuario */
  get groupsView(): string | null {
    return this.tokenPayload?.groupsView || null;
  }

  /** clientsPerPage del usuario */
  get clientsPerPage(): number | null {
    return this.tokenPayload?.clientsPerPage ?? null;
  }

  /**
 * Devuelve el rol principal del usuario según prioridad.
 */
  getCurrentRole(): string {
    if (this.isSuperAdmin) return 'super-admin';
    if (this.isOUAdmin) return 'ou-admin';
    if (this.isOUOperator) return 'ou-operator';
    if (this.isOUMinimal) return 'ou-minimal';
    return 'user';
  }

  /** Logout: limpia tokens y redirige al login */
  logout(options: { redirect?: boolean } = { redirect: true }): void {
    localStorage.removeItem('loginToken');
    localStorage.removeItem('refreshToken');
    localStorage.removeItem('isSuperAdmin');
    localStorage.removeItem('username');
    localStorage.removeItem('groupsView');
    localStorage.removeItem('language');
    this.tokenPayload = null;
    if (options.redirect && this.router.url !== '/auth/login') {
      this.router.navigate(['/auth/login']);
    }
  }
}