import { NextRequest, NextResponse } from 'next/server'
import { getServerSession } from 'next-auth'
import { authOptions } from '@/lib/auth'
import { featureFlags } from '@/lib/config'
import { canUseIntranetPenetration } from '@/lib/license'
import { prisma } from '@/lib/prisma'
import { isCurrentSuperAdmin } from '@/lib/admin-permissions'

export const dynamic = 'force-dynamic'

async function ensureTunnelEnabled() {
  if (featureFlags.tunnelEnabled) return true
  const settings = await prisma.systemSettings.findFirst({
    select: { enableTunnelService: true },
  })
  return !!settings?.enableTunnelService
}

export async function GET(req: NextRequest) {
  try {
    const session = await getServerSession(authOptions)
    if (!session) return NextResponse.json({ error: '未登录' }, { status: 401 })

    if ((session.user as any)?.role !== 'ADMIN' || !(await isCurrentSuperAdmin(session))) {
      return NextResponse.json({ error: '仅最高权限账号可操作内网穿透' }, { status: 403 })
    }

    const enabled = await ensureTunnelEnabled()
    if (!enabled) {
      return NextResponse.json({ enabled: false, status: 'disabled' })
    }

    if (!(await canUseIntranetPenetration())) {
      return NextResponse.json({
        enabled: false,
        status: 'license_restricted',
        error: '当前许可证不包含内网穿透功能，请联系管理员处理许可证',
      }, { status: 403 })
    }

    // TODO: 查询隧道状态
    return NextResponse.json({ enabled: true, status: 'stopped' })
  } catch (e) {
    console.error('Tunnel status error:', e)
    return NextResponse.json({ error: '服务异常' }, { status: 500 })
  }
}