import { getServerSession } from 'next-auth'
import type { NextRequest } from 'next/server'
import { authOptions } from '@/lib/auth'
import {
  DINGTALK_PERFORMANCE_SESSION_HEADER,
  verifyDingtalkPerformanceSessionToken,
} from '@/lib/dingtalk-performance-session'
import {
  DINGTALK_PERFORMANCE_SESSION_API_COOKIE,
  DINGTALK_PERFORMANCE_SESSION_COOKIE,
} from '@/lib/dingtalk-performance-session-constants'

export async function getAuthenticatedUploadUserId(request: NextRequest): Promise<string | null> {
  const headerToken = request.headers.get(DINGTALK_PERFORMANCE_SESSION_HEADER)
  const authorization = request.headers.get('authorization') || ''
  const bearerToken = authorization.match(/^Bearer\s+(.+)$/i)?.[1]?.trim()
  const cookieHeader = request.headers.get('cookie') || ''
  const cookies = cookieHeader
    .split(';')
    .map((part) => part.trim())
  const readCookie = (name: string) => {
    const cookie = cookies.find((part) => part.startsWith(`${name}=`))
    if (!cookie) return null
    const separator = cookie.indexOf('=')
    return separator >= 0 ? cookie.slice(separator + 1).trim() || null : null
  }
  // 新 Cookie 优先；旧版本可能还残留同名 API Cookie，不能让它遮蔽新凭证。
  const cookieToken = readCookie(DINGTALK_PERFORMANCE_SESSION_API_COOKIE)
    || readCookie(DINGTALK_PERFORMANCE_SESSION_COOKIE)
  const performanceTokens = [headerToken, bearerToken, cookieToken]
    .map((token) => String(token || '').trim())
    .filter((token, index, values) => Boolean(token) && values.indexOf(token) === index)
  for (const performanceToken of performanceTokens) {
    const performancePayload = verifyDingtalkPerformanceSessionToken(performanceToken)
    if (performancePayload?.userId) return String(performancePayload.userId).trim()
  }

  const session = await getServerSession(authOptions)
  const sessionUserId = String((session?.user as any)?.id || '').trim()
  return sessionUserId || null
}