import { NextRequest, NextResponse } from 'next/server'
import { getServerSession } from 'next-auth'
import { authOptions } from '@/lib/auth'
import { featureFlags } from '@/lib/config'
import { prisma } from '@/lib/prisma'

async function ensureTunnelEnabled() {
  if (featureFlags.tunnelEnabled) return true
  const settings = await prisma.systemSettings.findFirst({
    select: { enableTunnelService: true },
  })
  return !!settings?.enableTunnelService
}

export async function POST(req: NextRequest) {
  try {
    const session = await getServerSession(authOptions)
    if (!session) return NextResponse.json({ error: '未登录' }, { status: 401 })

    const isAdmin = (session.user as any)?.role === 'ADMIN'
    const isSuperAdmin = (session.user as any)?.isSuperAdmin
    // 仅超级管理员或已授权管理员可操作（目前限制最高权限）
    if (!isAdmin || !isSuperAdmin) {
      return NextResponse.json({ error: '仅最高权限账号可操作内网穿透' }, { status: 403 })
    }

    const enabled = await ensureTunnelEnabled()
    if (!enabled) {
      return NextResponse.json({ error: '内网穿透未启用' }, { status: 501 })
    }

    // TODO: 调用具体的隧道提供商启动逻辑
    return NextResponse.json({
      message: '隧道启动成功（占位）',
      tunnelUrl: 'https://mock-tunnel.example.com',
      expiresAt: null,
    })
  } catch (e) {
    console.error('Tunnel start error:', e)
    return NextResponse.json({ error: '服务异常' }, { status: 500 })
  }
}