import { S3Client, GetObjectCommand } from '@aws-sdk/client-s3';
import { getSignedUrl } from '@aws-sdk/s3-request-presigner';

const s3 = new S3Client({ region: process.env.AWS_REGION });

// Generate a short-lived presigned URL for each download attempt
export async function generateDownloadUrl(orderId: string, digitalProductId: string) {
  const access = await db.orderDigitalAccess.findUnique({
    where: { orderId_digitalProductId: { orderId, digitalProductId } },
    include: { digitalProduct: true },
  });

  if (!access) throw new Error('No access record found');
  if (access.expiresAt && access.expiresAt < new Date()) throw new Error('Download access has expired');
  if (access.maxDownloads && access.downloadCount >= access.maxDownloads) throw new Error('Download limit reached');

  // Atomically increment download count
  await db.orderDigitalAccess.update({ where: { id: access.id }, data: { downloadCount: { increment: 1 } } });

  // 60-second presigned URL — short enough to prevent sharing, long enough for the redirect
  const command = new GetObjectCommand({
    Bucket: process.env.DIGITAL_PRODUCTS_BUCKET,
    Key: access.digitalProduct.fileStorageKey,
    ResponseContentDisposition: `attachment; filename="${access.digitalProduct.fileName}"`,
  });

  return getSignedUrl(s3, command, { expiresIn: 60 });
}

// Provision access after payment — call this from your payment webhook
export async function provisionDigitalAccess(orderId: string) {
  const order = await db.orders.findUnique({
    where: { id: orderId },
    include: { items: { include: { variant: { include: { digitalProduct: true } } } } },
  });

  for (const item of order.items.filter(i => i.variant.digitalProduct)) {
    const dp = item.variant.digitalProduct;
    await db.orderDigitalAccess.upsert({
      where: { orderId_digitalProductId: { orderId, digitalProductId: dp.id } },
      create: {
        orderId, digitalProductId: dp.id, downloadCount: 0,
        maxDownloads: dp.downloadLimit,
        expiresAt: dp.accessDurationDays ? new Date(Date.now() + dp.accessDurationDays * 86400000) : null,
      },
      update: {}, // Idempotent — webhooks can fire multiple times
    });
  }
}

// License key pool management
export async function assignLicenseKey(orderId: string, productId: string) {
  return db.$transaction(async tx => {
    const license = await tx.digitalProductLicenses.findFirst({
      where: { productId, status: 'available' },
    });
    if (!license) throw new Error(`No available license keys for product ${productId}`);
    await tx.digitalProductLicenses.update({
      where: { id: license.id },
      data: { status: 'sold', orderId, soldAt: new Date() },
    });
    return license.licenseKey;
  });
}