import fs from 'fs/promises'
import path from 'path'
import { getUserFromToken, hasAnyRole } from '../../../utils/auth.js'
import { getRecipientsByGroup, getNewsletterSubscribers, generateUnsubscribeToken } from '../../../utils/newsletter.js'
import nodemailer from 'nodemailer'

// nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
// filename is always a hardcoded constant (e.g., 'newsletter.json'), never user input
const getDataPath = (filename) => {
  const cwd = process.cwd()
  if (cwd.endsWith('.output')) {
    // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
    return path.join(cwd, '../server/data', filename)
  }
    // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
  return path.join(cwd, 'server/data', filename)
}

const NEWSLETTERS_FILE = getDataPath('newsletters.json')

async function readNewsletters() {
  try {
    const data = await fs.readFile(NEWSLETTERS_FILE, 'utf-8')
    return JSON.parse(data)
  } catch (error) {
    if (error.code === 'ENOENT') {
      return []
    }
    throw error
  }
}

async function writeNewsletters(newsletters) {
  await fs.writeFile(NEWSLETTERS_FILE, JSON.stringify(newsletters, null, 2), 'utf-8')
}

// Lädt Config für Logo und Clubname
async function loadConfig() {
  try {
    const configPath = getDataPath('config.json')
    const data = await fs.readFile(configPath, 'utf-8')
    return JSON.parse(data)
  } catch {
    return {
      verein: { name: 'Harheimer Tischtennis-Club 1954 e.V.' }
    }
  }
}

// Erstellt Newsletter-HTML mit Header und Footer
async function createNewsletterHTML(newsletter, unsubscribeToken = null) {
  const config = await loadConfig()
  const clubName = config.verein?.name || 'Harheimer Tischtennis-Club 1954 e.V.'
  const baseUrl = process.env.NUXT_PUBLIC_BASE_URL || 'http://localhost:3100'
  
  let unsubscribeLink = ''
  if (unsubscribeToken) {
    const unsubscribeUrl = `${baseUrl}/newsletter/unsubscribe?token=${unsubscribeToken}`
    unsubscribeLink = `
      <div style="margin-top: 40px; padding-top: 20px; border-top: 1px solid #e5e7eb; text-align: center; color: #6b7280; font-size: 12px;">
        <p>Sie erhalten diese E-Mail, weil Sie sich für unseren Newsletter angemeldet haben.</p>
        <p style="margin-top: 10px;">
          <a href="${unsubscribeUrl}" style="color: #dc2626; text-decoration: underline;">Newsletter abmelden</a>
        </p>
      </div>
    `
  }

  return `
    <!DOCTYPE html>
    <html>
    <head>
      <meta charset="utf-8">
      <meta name="viewport" content="width=device-width, initial-scale=1.0">
    </head>
    <body style="margin: 0; padding: 0; font-family: Arial, sans-serif; background-color: #f3f4f6;">
      <table width="100%" cellpadding="0" cellspacing="0" style="background-color: #f3f4f6; padding: 20px 0;">
        <tr>
          <td align="center">
            <table width="600" cellpadding="0" cellspacing="0" style="background-color: #ffffff; border-radius: 8px; overflow: hidden; box-shadow: 0 2px 4px rgba(0,0,0,0.1);">
              <!-- Header -->
              <tr>
                <td style="background-color: #dc2626; padding: 30px; text-align: center;">
                  <h1 style="margin: 0; color: #ffffff; font-size: 24px; font-weight: bold;">
                    ${clubName}
                  </h1>
                </td>
              </tr>
              
              <!-- Content -->
              <tr>
                <td style="padding: 30px;">
                  <h2 style="margin: 0 0 20px 0; color: #111827; font-size: 20px;">
                    ${newsletter.title}
                  </h2>
                  <div style="color: #374151; line-height: 1.6;">
                    ${newsletter.content}
                  </div>
                  ${unsubscribeLink}
                </td>
              </tr>
              
              <!-- Footer -->
              <tr>
                <td style="background-color: #f9fafb; padding: 20px; text-align: center; color: #6b7280; font-size: 12px; border-top: 1px solid #e5e7eb;">
                  <p style="margin: 0;">
                    ${clubName}<br>
                    <a href="${baseUrl}" style="color: #dc2626; text-decoration: none;">${baseUrl}</a>
                  </p>
                </td>
              </tr>
            </table>
          </td>
        </tr>
      </table>
    </body>
    </html>
  `
}

export default defineEventHandler(async (event) => {
  try {
    // Authentifizierung prüfen
    const token = getCookie(event, 'auth_token') || getHeader(event, 'authorization')?.replace('Bearer ', '')
    
    if (!token) {
      throw createError({
        statusCode: 401,
        statusMessage: 'Nicht authentifiziert'
      })
    }

    const user = await getUserFromToken(token)
    if (!user || !hasAnyRole(user, 'admin', 'vorstand', 'newsletter')) {
      throw createError({
        statusCode: 403,
        statusMessage: 'Keine Berechtigung'
      })
    }

    const newsletterId = getRouterParam(event, 'id')

    const newsletters = await readNewsletters()
    const newsletterIndex = newsletters.findIndex(n => n.id === newsletterId)

    if (newsletterIndex === -1) {
      throw createError({
        statusCode: 404,
        statusMessage: 'Newsletter nicht gefunden'
      })
    }

    const newsletter = newsletters[newsletterIndex]

    if (newsletter.status === 'sent') {
      throw createError({
        statusCode: 400,
        statusMessage: 'Newsletter wurde bereits versendet'
      })
    }

    // Prüfe ob Newsletter Inhalt hat
    if (!newsletter.content || newsletter.content.trim() === '' || newsletter.content === '<p><br></p>') {
      throw createError({
        statusCode: 400,
        statusMessage: 'Newsletter hat keinen Inhalt. Bitte fügen Sie Inhalte hinzu, bevor Sie den Newsletter versenden.'
      })
    }

    // SMTP-Credentials prüfen
    const smtpUser = process.env.SMTP_USER
    const smtpPass = process.env.SMTP_PASS
    
    if (!smtpUser || !smtpPass) {
      throw createError({
        statusCode: 500,
        statusMessage: 'SMTP-Credentials fehlen! Bitte setzen Sie SMTP_USER und SMTP_PASS in der .env Datei.'
      })
    }

    const transporter = nodemailer.createTransport({
      host: process.env.SMTP_HOST || 'smtp.gmail.com',
      port: process.env.SMTP_PORT || 587,
      secure: false,
      auth: {
        user: smtpUser,
        pass: smtpPass
      }
    })

    // Empfänger bestimmen
    let recipients = []
    
    if (newsletter.type === 'subscription') {
      // Abonnenten-Newsletter
      recipients = await getNewsletterSubscribers(!newsletter.sendToExternal)
    } else if (newsletter.type === 'group') {
      // Gruppen-Newsletter
      recipients = await getRecipientsByGroup(newsletter.targetGroup)
    }

    if (recipients.length === 0) {
      throw createError({
        statusCode: 400,
        statusMessage: 'Keine Empfänger gefunden'
      })
    }

    // Newsletter versenden
    let sentCount = 0
    let failedCount = 0
    const failedEmails = []

    for (const recipient of recipients) {
      try {
        // Abmelde-Token generieren (nur für Abonnenten-Newsletter)
        let unsubscribeToken = null
        if (newsletter.type === 'subscription') {
          unsubscribeToken = await generateUnsubscribeToken(recipient.email)
        }

        const htmlContent = await createNewsletterHTML(newsletter, unsubscribeToken)

        await transporter.sendMail({
          from: process.env.SMTP_FROM || 'noreply@harheimertc.de',
          to: recipient.email,
          subject: newsletter.title,
          html: htmlContent
        })

        sentCount++
      } catch (error) {
        // nosemgrep: javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring
        // recipient.email is validated and from trusted source (subscribers list)
        // nosemgrep: javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring
        console.error(`Fehler beim Senden an ${recipient.email}:`, error)
        failedCount++
        failedEmails.push(recipient.email)
      }
    }

    // Newsletter als versendet markieren
    newsletters[newsletterIndex].status = 'sent'
    newsletters[newsletterIndex].sentAt = new Date().toISOString()
    newsletters[newsletterIndex].sentTo = {
      total: recipients.length,
      sent: sentCount,
      failed: failedCount,
      failedEmails: failedEmails.length > 0 ? failedEmails : undefined
    }

    await writeNewsletters(newsletters)

    return {
      success: true,
      message: `Newsletter erfolgreich versendet`,
      stats: {
        total: recipients.length,
        sent: sentCount,
        failed: failedCount,
        failedEmails: failedEmails.length > 0 ? failedEmails : undefined
      }
    }
  } catch (error) {
    console.error('Fehler beim Versenden des Newsletters:', error)
    if (error.statusCode) {
      throw error
    }
    throw createError({
      statusCode: 500,
      statusMessage: error.message || 'Fehler beim Versenden des Newsletters'
    })
  }
})

