import { NextRequest, NextResponse } from 'next/server'
import { getServerSession } from 'next-auth'
import { authOptions } from '@/lib/auth'
import { featureFlags } from '@/lib/config'
import { canUseIntranetPenetration } from '@/lib/license'
import { prisma } from '@/lib/prisma'
import { isCurrentSuperAdmin } from '@/lib/admin-permissions'

async function ensureTunnelEnabled() {
  if (featureFlags.tunnelEnabled) return true
  const settings = await prisma.systemSettings.findFirst({
    select: { enableTunnelService: true },
  })
  return !!settings?.enableTunnelService
}

export async function POST(req: NextRequest) {
  try {
    const session = await getServerSession(authOptions)
    if (!session) return NextResponse.json({ error: '未登录' }, { status: 401 })

    if ((session.user as any)?.role !== 'ADMIN' || !(await isCurrentSuperAdmin(session))) {
      return NextResponse.json({ error: '仅最高权限账号可操作内网穿透' }, { status: 403 })
    }

    const enabled = await ensureTunnelEnabled()
    if (!enabled) {
      return NextResponse.json({ error: '内网穿透未启用' }, { status: 501 })
    }

    if (!(await canUseIntranetPenetration())) {
      return NextResponse.json({ error: '当前许可证不包含内网穿透功能，请联系管理员处理许可证' }, { status: 403 })
    }

    // TODO: 调用隧道提供商停止逻辑
    return NextResponse.json({ message: '隧道已停止（占位）' })
  } catch (e) {
    console.error('Tunnel stop error:', e)
    return NextResponse.json({ error: '服务异常' }, { status: 500 })
  }
}