package web

import (
	"net/http"

	"git.noroutes.net/NoRoutes/vibetunes/internal/database"
)

func (h *Web) handleAdminAPIKeys(w http.ResponseWriter, r *http.Request) {
	keys, err := database.ListAllAPIKeys(h.DB)
	if err != nil {
		http.Error(w, "internal error", http.StatusInternalServerError)
		return
	}
	type keyView struct {
		Key      *database.APIKey
		Username string
	}
	var views []keyView
	for _, k := range keys {
		username := k.UserID
		if u, err := database.GetUserByID(h.DB, k.UserID); err == nil {
			username = u.Username
		}
		views = append(views, keyView{Key: k, Username: username})
	}
	h.page(w, r, "admin_api_keys", "admin_api_keys", "API Keys", views)
}

// handleAdminAPIKeyRevoke lets an admin revoke any user's API key — the
// self-service /settings/api-keys/{id}/revoke route only allows revoking
// your own.
func (h *Web) handleAdminAPIKeyRevoke(w http.ResponseWriter, r *http.Request) {
	id := r.PathValue("id")
	if _, err := database.GetAPIKey(h.DB, id); err != nil {
		http.NotFound(w, r)
		return
	}
	if err := database.RevokeAPIKey(h.DB, id); err != nil {
		http.Error(w, "internal error", http.StatusInternalServerError)
		return
	}
	http.Redirect(w, r, "/admin/api-keys", http.StatusFound)
}