text: const express = require('express');
  const common = require('../../lib/common');
  const { restrict } = require('../../lib/auth');
  const colors = require('colors');
  const bcrypt = require('bcryptjs');
  const router = express.Router();
  
  
  router.get('/admin/users', restrict, async (req, res) => {
      const db = req.app.db;
      const users = await db.users.find({}, { projection: { userPassword: 0 } }).toArray();
  
      if(req.apiAuthenticated){
          res.status(200).json(users);
          return;
      }
  
      res.render('users', {
          title: 'Users',
          users: users,
          admin: true,
          config: req.app.config,
          isAdmin: req.session.isAdmin,
          helpers: req.handlebars.helpers,
          session: req.session,
          message: common.clearSessionValue(req.session, 'message'),
          messageType: common.clearSessionValue(req.session, 'messageType')
      });
  });
  
  // edit user
  router.get('/admin/user/edit/:id', restrict, async (req, res) => {
      const db = req.app.db;
      const user = await db.users.findOne({ _id: common.getId(req.params.id) });
  
      // Check user is found
      if(!user){
          if(req.apiAuthenticated){
              res.status(400).json({ message: 'User not found' });
              return;
          }
  
          req.session.message = 'User not found';
          req.session.messageType = 'danger';
          res.redirect('/admin/users');
          return;
      }
  
      // if the user we want to edit is not the current logged in user and the current user is not
      // an admin we render an access denied message
      if(user.userEmail !== req.session.user && req.session.isAdmin === false){
          if(req.apiAuthenticated){
              res.status(400).json({ message: 'Access denied' });
              return;
          }
  
          req.session.message = 'Access denied';
          req.session.messageType = 'danger';
          res.redirect('/admin/users');
          return;
      }
  
      res.render('user_edit', {
          title: 'User edit',
          user: user,
          admin: true,
          session: req.session,
          message: common.clearSessionValue(req.session, 'message'),
          messageType: common.clearSessionValue(req.session, 'messageType'),
          helpers: req.handlebars.helpers,
          config: req.app.config
      });
  });
  
  // users new
  router.get('/admin/user/new', restrict, (req, res) => {
      res.render('user_new', {
          title: 'User - New',
          admin: true,
          session: req.session,
          helpers: req.handlebars.helpers,
          message: common.clearSessionValue(req.session, 'message'),
          messageType: common.clearSessionValue(req.session, 'messageType'),
          config: req.app.config
      });
  });
  
  // delete user
  // TODO: change it to DELETE
  router.get('/admin/user/delete/:id', restrict, async (req, res) => {
      const db = req.app.db;
  
      // userId
      if(req.session.isAdmin !== true){
          if(req.apiAuthenticated){
              res.status(400).json({ message: 'Access denied' });
              return;
          }
  
          req.session.message = 'Access denied.';
          req.session.messageType = 'danger';
          res.redirect('/admin/users');
          return;
      }
  
      // Cannot delete your own account
      if(req.session.userId === req.params.id){
          if(req.apiAuthenticated){
              res.status(400).json({ message: 'Unable to delete own user account' });
              return;
          }
  
          req.session.message = 'Unable to delete own user account.';
          req.session.messageType = 'danger';
          res.redirect('/admin/users');
          return;
      }
  
      const user = await db.users.findOne({ _id: common.getId(req.params.id) });
  
      // If user is not found
      if(!user){
          if(req.apiAuthenticated){
              res.status(400).json({ message: 'User not found.' });
              return;
          }
  
          req.session.message = 'User not found.';
          req.session.messageType = 'danger';
          res.redirect('/admin/users');
          return;
      }
  
      // Cannot delete the original user/owner
      if(user.isOwner){
          if(req.apiAuthenticated){
              res.status(400).json({ message: 'Access denied.' });
              return;
          }
  
          req.session.message = 'Access denied.';
          req.session.messageType = 'danger';
          res.redirect('/admin/users');
          return;
      }
  
      try{
          await db.users.deleteOne({ _id: common.getId(req.params.id) }, {});
          if(req.apiAuthenticated){
              res.status(200).json({ message: 'User deleted.' });
              return;
          }
          req.session.message = 'User deleted.';
          req.session.messageType = 'success';
          res.redirect('/admin/users');
      }catch(ex){
          console.log('Failed to delete user', ex);
          if(req.apiAuthenticated){
              res.status(200).json({ message: 'Cannot delete user' });
              return;
          }
          req.session.message = 'Cannot delete user';
          req.session.messageType = 'danger';
          res.redirect('/admin/users');
      };
  });
  
  // update a user
  router.post('/admin/user/update', restrict, async (req, res) => {
      const db = req.app.db;
  
      let isAdmin = req.body.user_admin === 'on';
  
      // get the user we want to update
      const user = await db.users.findOne({ _id: common.getId(req.body.userId) });
  
      // If user not found
      if(!user){
          if(req.apiAuthenticated){
              res.status(400).json({ message: 'User not found' });
              return;
          }
  
          req.session.message = 'User not found';
          req.session.messageType = 'danger';
          res.redirect('/admin/users');
          return;
      }
  
      // If the current user changing own account ensure isAdmin retains existing
      if(user.userEmail === req.session.user){
          isAdmin = user.isAdmin;
      }
  
      // if the user we want to edit is not the current logged in user and the current user is not
      // an admin we render an access denied message
      if(user.userEmail !== req.session.user && req.session.isAdmin === false){
          if(req.apiAuthenticated){
              res.status(400).json({ message: 'Access denied' });
              return;
          }
  
          req.session.message = 'Access denied';
          req.session.messageType = 'danger';
          res.redirect('/admin/users');
          return;
      }
  
      // create the update doc
      const updateDoc = {};
      updateDoc.isAdmin = isAdmin;
      updateDoc.usersName = req.body.usersName;
      if(req.body.userPassword){
          updateDoc.userPassword = bcrypt.hashSync(req.body.userPassword);
      }
  
      try{
          await db.users.updateOne(
              { _id: common.getId(req.body.userId) },
              {
                  $set: updateDoc
              }, { multi: false }
          );
          if(req.apiAuthenticated){
              res.status(200).json({ message: 'User account updated.' });
              return;
          }
          // show the view
          req.session.message = 'User account updated.';
          req.session.messageType = 'success';
          res.redirect('/admin/user/edit/' + req.body.userId);
      }catch(ex){
          if(req.apiAuthenticated){
              res.status(400).json({ message: 'Failed to update user' });
              return;
          }
          console.error(colors.red('Failed updating user: ' + ex));
          req.session.message = 'Failed to update user';
          req.session.messageType = 'danger';
          res.redirect('/admin/user/edit/' + req.body.userId);
      }
  });
  
  // insert a user
  router.post('/admin/user/insert', restrict, async (req, res) => {
      const db = req.app.db;
  
      // set the account to admin if using the setup form. Eg: First user account
      const urlParts = new URL(req.header('Referer'));
  
      // Check number of users
      const userCount = await db.users.countDocuments({});
      let isAdmin = false;
  
      // if no users, setup user as admin
      if(userCount === 0){
          isAdmin = true;
      }
  
      const doc = {
          usersName: req.body.usersName,
          userEmail: req.body.userEmail,
          userPassword: bcrypt.hashSync(req.body.userPassword, 10),
          isAdmin: isAdmin
      };
  
      // check for existing user
      const user = await db.users.findOne({ userEmail: req.body.userEmail });
      if(user){
          if(req.apiAuthenticated){
              res.status(400).json({ message: 'A user with that email address already exists' });
              return;
          }
          // user already exists with that email address
          console.error(colors.red('Failed to insert user, possibly already exists'));
          req.session.message = 'A user with that email address already exists';
          req.session.messageType = 'danger';
          res.redirect('/admin/user/new');
          return;
      }
      // email is ok to be used.
      try{
          await db.users.insertOne(doc);
          // if from setup we add user to session and redirect to login.
          // Otherwise we show users screen
          if(urlParts.path === '/admin/setup'){
              req.session.user = req.body.userEmail;
              res.redirect('/admin/login');
              return;
          }
          if(req.apiAuthenticated){
              res.status(200).json({ message: 'User account inserted' });
              return;
          }
  
          req.session.message = 'User account inserted';
          req.session.messageType = 'success';
          res.redirect('/admin/users');
      }catch(ex){
          if(req.apiAuthenticated){
              res.status(400).json({ message: 'New user creation failed' });
              return;
          }
          console.error(colors.red('Failed to insert user: ' + ex));
          req.session.message = 'New user creation failed';
          req.session.messageType = 'danger';
          res.redirect('/admin/user/new');
      }
  });
  
  module.exports = router;
  