import { auth } from '@/auth'
import { prisma } from '@/lib/prisma'
import { NextResponse } from 'next/server'

/**
 * Checks if the authenticated user has explicit GDPR AI processing consent.
 * Persistent consent: UserAISettings.aiProcessingConsent
 * Session-only consent: signed JWT claim (not client headers — GDPR-safe)
 */
export async function hasUserAiConsent(): Promise<boolean> {
  const session = await auth()
  if (!session?.user?.id) {
    return false
  }

  if (session.aiSessionConsent === true) {
    return true
  }

  const settings = await prisma.userAISettings.findUnique({
    where: { userId: session.user.id },
    select: { aiProcessingConsent: true },
  })

  return settings?.aiProcessingConsent ?? false
}

const DEFAULT_AI_CONSENT_MESSAGE = 'AI processing consent is required to use this feature.'
const AI_CONSENT_ERROR_KEY = 'consent.ai.requiredToast'

export function aiConsentForbiddenResponse(message?: string) {
  return NextResponse.json(
    { error: message ?? DEFAULT_AI_CONSENT_MESSAGE, code: 'ai_consent_required', errorKey: AI_CONSENT_ERROR_KEY },
    { status: 403 }
  )
}

export function aiConsentForbiddenJson(message?: string) {
  return NextResponse.json(
    { success: false, error: message ?? DEFAULT_AI_CONSENT_MESSAGE, code: 'ai_consent_required', errorKey: AI_CONSENT_ERROR_KEY },
    { status: 403 }
  )
}