import { config } from '../config.js'
import {
  getUserById,
  listDocuments,
  Query,
  updateAppwriteUserEmailVerification,
  updateAppwriteUserMfa,
} from './appwriteAdmin.js'

/**
 * Mitarbeiter-2FA verwalten (scripts/mitarbeiter-2fa.mjs). Appwrite verlangt den E-Mail-Code nur, wenn
 * die Adresse bestaetigt ist - deshalb beim Einschalten erst bestaetigen, dann 2FA an.
 */
export async function listStaffMfaStatus() {
  const employees = await listDocuments(config.collections.employees, [Query.limit(100)])
  const rows = []
  for (const employee of employees) {
    if (!employee.userId) continue
    const user = await getUserById(employee.userId)
    rows.push({
      userId: employee.userId,
      name: employee.displayName || user.name || '',
      email: user.email || employee.email || '',
      emailVerification: Boolean(user.emailVerification),
      mfa: Boolean(user.mfa),
    })
  }
  return rows
}

export async function enableStaffMfa(userId) {
  await updateAppwriteUserEmailVerification(userId, true)
  await updateAppwriteUserMfa(userId, true)
}

export async function disableStaffMfa(userId) {
  await updateAppwriteUserMfa(userId, false)
}