// ============================================================================
// W5 runtime body — footer purchase/expiry lookup (PUBLIC, READ-ONLY).
// Trigger: GET webhook /dk-purchase-check?u=<username>
// Returns:  { username, known, purchases: [{product, expires_at, display_state}] }
//
// Security model (no HMAC — key would ship to the client, so it is theatre):
//   - CORS: response header Access-Control-Allow-Origin: https://drive.digikedai.com
//     → only the AList portal origin may READ the response from a browser.
//   - Minimal data: product name + expiry + display_state only (no internal Ids).
//   - Server-side enumeration is mitigated by a Cloudflare WAF rate-limit +
//     Origin/Referer rule on auto.hoelee.com (see delivery guide).
//   - No AList auth requests of any kind (username comes from the caller's own
//     JWT, decoded client-side in the footer) → no empty-client device drift.
// ============================================================================

// n8n Code node context (same pattern as W1–W4).
const ctx = { $env, helpers: this.helpers };

// GET webhook: n8n puts query-string params under $json.query (fallback: body).
const item = $json ?? ($input && $input.item ? $input.item.json : {});
const q = item.query ?? item.body ?? {};
const username = String(q.u ?? '').trim();

function linkId(v) {
  if (v == null) return null;
  if (typeof v === 'object' && !Array.isArray(v)) return v.Id ?? v.id ?? null;
  if (Array.isArray(v)) return v[0]?.Id ?? v[0]?.id ?? null;
  return v;
}

async function ncGet(path) {
  return await ctx.helpers.httpRequest({
    method: 'GET',
    url: ctx.$env.NOCODB_URL + path,
    headers: { 'xc-token': ctx.$env.NOCODB_TOKEN },
    json: true,
  });
}

const empty = () => ({ username, known: false, purchases: [] });

if (!username) return { json: empty() };

try {
  const T_CUST = ctx.$env.NOCODB_TABLE_CUSTOMERS;
  const T_CP = ctx.$env.NOCODB_TABLE_CUSTOMERPRODUCTS;
  const today = new Date().toISOString().slice(0, 10);

  // 1. resolve username -> customer (username is unique in Customers)
  const custRows = (await ncGet(
    `/api/v2/tables/${T_CUST}/records?where=(username,eq,${encodeURIComponent(username)})&limit=1`
  )).list || [];
  const customer = custRows[0];
  if (!customer) return { json: empty() };

  // 2. this customer's products (link query by Id, per NocoDB v2 gotchas)
  const cps = (await ncGet(
    `/api/v2/tables/${T_CP}/records?where=(customer.Id,eq,${customer.Id})&limit=500`
  )).list || [];

  const purchases = cps
    .map((c) => {
      const productObj = (typeof c.product === 'object' && c.product) ? c.product : null;
      const name = productObj && productObj.name ? String(productObj.name) : 'Product';
      const expires = c.expires_at ? String(c.expires_at).slice(0, 10) : null;
      let state = (c.status && c.status !== 'active') ? c.status : 'active';
      if (state === 'active' && expires && expires <= today) state = 'expired';
      return { product: name, expires_at: expires, display_state: state };
    })
    .sort((a, b) => {
      const rank = { active: 0, suspended: 1, revoked: 2, expired: 3 };
      if (rank[a.display_state] !== rank[b.display_state]) return rank[a.display_state] - rank[b.display_state];
      return String(a.expires_at || '').localeCompare(String(b.expires_at || ''));
    });

  return { json: { username, known: true, purchases } };
} catch (err) {
  // graceful: footer renders static rows only on any error
  return { json: { ...empty(), error: String((err && err.message) || err) } };
}