package httpapi

import (
	"net/http"

	"github.com/descrybe/descrybe-v2/apps/api/internal/feeds"
	"github.com/descrybe/descrybe-v2/apps/api/internal/platformsettings"
)

// GET /api/admin/settings — platform integration config (secrets masked).
func (s *Server) handleGetAdminSettings(w http.ResponseWriter, r *http.Request) {
	if s.PlatformSettings == nil {
		Error(w, http.StatusServiceUnavailable, "platform settings unavailable")
		return
	}
	view, err := s.PlatformSettings.GetPublic(r.Context())
	if err != nil {
		Error(w, http.StatusInternalServerError, "failed to load platform settings")
		return
	}
	JSON(w, http.StatusOK, view)
}

// PUT /api/admin/settings — partial update; omit secrets to keep existing.
func (s *Server) handlePutAdminSettings(w http.ResponseWriter, r *http.Request) {
	if s.PlatformSettings == nil {
		Error(w, http.StatusServiceUnavailable, "platform settings unavailable")
		return
	}
	var body platformsettings.UpdateInput
	if err := DecodeJSON(r, &body); err != nil {
		Error(w, http.StatusBadRequest, "invalid json")
		return
	}
	view, err := s.PlatformSettings.Update(r.Context(), body)
	if err != nil {
		ClientOrLog(w, http.StatusBadRequest, "could not update platform settings", err, platformsettings.ClientError)
		return
	}
	// OpenAI / ai_roles / SMTP / OAuth / Stripe / EPREL resolve at use time — no client cache to drop.
	// Feed private allowlist is process-global; refresh immediately after a successful PUT.
	if body.Values != nil {
		if _, ok := body.Values[platformsettings.KeyFeedPrivateAllowlist]; ok {
			csv, _ := s.PlatformSettings.ResolveFeedPrivateAllowlist(r.Context())
			feeds.ApplyPrivateAllowlistCSV(csv)
		}
	}
	JSON(w, http.StatusOK, view)
}