const express = require("express");
const crypto = require("crypto");
const db = require("../db/polygons");
const { getBBox } = require("../utils/bbox");

const router = express.Router();
const LOCK_TTL_MS = 15 * 60 * 1000;

router.get("/", (_req, res) => {
    const rows = db.prepare(`
        SELECT
            s.*,
            st.status,
            st.head_commit_id,
            st.version,
            st.locked_by,
            st.locked_at,
            st.lock_expires_at
        FROM sections s
        LEFT JOIN section_states st
          ON st.section_id = s.id
        ORDER BY s.updated_at DESC
    `).all();

    res.json(rows.map(normalizeSectionRow));
});

router.post("/", (req, res) => {
    const title = normalizeRequiredString(req.body?.title);
    if (!title) {
        return res.status(400).json({ error: "title is required" });
    }

    const id = normalizeId(req.body?.id) || crypto.randomUUID();
    const now = new Date().toISOString();
    const description = normalizeOptionalString(req.body?.description);
    const userId = normalizeActor(req.body?.user_id || req.body?.created_by);
    const createdBy = normalizeActor(req.body?.created_by || req.body?.user_id);

    try {
        const tx = db.transaction(() => {
            db.prepare(`
                INSERT INTO sections (id, title, description, user_id, created_by, created_at, updated_at)
                VALUES (?, ?, ?, ?, ?, ?, ?)
            `).run(id, title, description, userId, createdBy, now, now);

            ensureSectionState(id, now);
        });
        tx();
    } catch (err) {
        if (isSqliteConstraint(err)) {
            return res.status(409).json({ error: "Section id already exists" });
        }
        console.error("Create section failed", err);
        return res.status(500).json({ error: "Create section failed" });
    }

    res.status(201).json(getSectionById(id));
});

router.get("/:sectionId/editor", (req, res) => {
    const section = getSectionById(req.params.sectionId);
    if (!section) {
        return res.status(404).json({ error: "Section not found" });
    }

    const actor = normalizeActor(req.query.user_id || req.query.user || req.get("x-user-id"));
    const now = new Date().toISOString();
    let state;
    let commit = null;

    try {
        const tx = db.transaction(() => {
            state = ensureSectionState(section.id, now);
            assertLockAvailable(state, actor, now);
            if (actor) {
                state = acquireLock(section.id, actor, now);
            }
            if (state.head_commit_id) {
                commit = getCommitForSection(section.id, state.head_commit_id);
            }
        });
        tx();
    } catch (err) {
        if (err.status) {
            return res.status(err.status).json({ error: err.message });
        }
        console.error("Open editor failed", err);
        return res.status(500).json({ error: "Open editor failed" });
    }

    res.json({
        section,
        state: normalizeStateRow(state),
        commit: commit ? normalizeCommitRow(commit, false) : null,
        snapshot: commit ? parseSnapshotJson(commit.snapshot_json) : buildEmptySnapshot(section),
    });
});

router.post("/:sectionId/lock", (req, res) => {
    const actor = normalizeActor(req.body?.user_id || req.body?.user || req.get("x-user-id"));
    if (!actor) {
        return res.status(400).json({ error: "user_id is required" });
    }

    const section = getSectionById(req.params.sectionId);
    if (!section) {
        return res.status(404).json({ error: "Section not found" });
    }

    const now = new Date().toISOString();
    try {
        const state = db.transaction(() => {
            const current = ensureSectionState(section.id, now);
            assertLockAvailable(current, actor, now);
            return acquireLock(section.id, actor, now);
        })();
        res.json({ state: normalizeStateRow(state) });
    } catch (err) {
        if (err.status) {
            return res.status(err.status).json({ error: err.message });
        }
        console.error("Lock section failed", err);
        res.status(500).json({ error: "Lock section failed" });
    }
});

router.post("/:sectionId/unlock", (req, res) => {
    const actor = normalizeActor(req.body?.user_id || req.body?.user || req.get("x-user-id"));
    const section = getSectionById(req.params.sectionId);
    if (!section) {
        return res.status(404).json({ error: "Section not found" });
    }

    const state = ensureSectionState(section.id, new Date().toISOString());
    if (state.locked_by && actor && state.locked_by !== actor) {
        return res.status(409).json({ error: "Section is locked by another user" });
    }

    db.prepare(`
        UPDATE section_states
        SET locked_by = NULL,
            locked_at = NULL,
            lock_expires_at = NULL,
            updated_at = ?
        WHERE section_id = ?
    `).run(new Date().toISOString(), section.id);

    res.json({ success: true });
});

router.get("/:sectionId/commits", (req, res) => {
    const section = getSectionById(req.params.sectionId);
    if (!section) {
        return res.status(404).json({ error: "Section not found" });
    }

    const includeSnapshot = req.query.include_snapshot === "1" || req.query.include_snapshot === "true";
    const rows = db.prepare(`
        SELECT *
        FROM section_commits
        WHERE section_id = ?
        ORDER BY commit_no DESC
    `).all(section.id);

    res.json(rows.map((row) => normalizeCommitRow(row, includeSnapshot)));
});

router.post("/:sectionId/commits", (req, res) => {
    const section = getSectionById(req.params.sectionId);
    if (!section) {
        return res.status(404).json({ error: "Section not found" });
    }

    const actor = normalizeActor(req.body?.created_by || req.body?.user_id || req.get("x-user-id"));
    if (!actor) {
        return res.status(400).json({ error: "created_by is required" });
    }

    const snapshotResult = normalizeSnapshotInput(req.body?.snapshot_json ?? req.body?.snapshot);
    if (snapshotResult.error) {
        return res.status(400).json({ error: snapshotResult.error });
    }

    try {
        const result = db.transaction(() => {
            const now = new Date().toISOString();
            const state = ensureSectionState(section.id, now);
            assertCanEdit(state, actor, now);
            assertExpectedState(state, req.body);
            validateSnapshot(snapshotResult.snapshot);

            const commit = insertCommit({
                section,
                state,
                snapshotJson: snapshotResult.snapshotJson,
                snapshotHash: hashString(snapshotResult.snapshotJson),
                kind: "manual",
                restoredFromCommitId: null,
                actor,
                title: normalizeOptionalString(req.body?.title),
                note: normalizeOptionalString(req.body?.note),
                now,
            });

            const nextState = setHeadCommit(section.id, commit.id, now);
            return { commit, state: nextState };
        })();

        res.status(201).json({
            commit: normalizeCommitRow(result.commit, true),
            state: normalizeStateRow(result.state),
        });
    } catch (err) {
        handleRouteError(res, err, "Create commit failed");
    }
});

router.post("/:sectionId/restore", (req, res) => {
    const section = getSectionById(req.params.sectionId);
    if (!section) {
        return res.status(404).json({ error: "Section not found" });
    }

    const actor = normalizeActor(req.body?.created_by || req.body?.user_id || req.get("x-user-id"));
    const restoreCommitId = normalizeId(req.body?.commit_id || req.body?.restore_commit_id);
    if (!actor) {
        return res.status(400).json({ error: "created_by is required" });
    }
    if (!restoreCommitId) {
        return res.status(400).json({ error: "commit_id is required" });
    }

    try {
        const result = db.transaction(() => {
            const now = new Date().toISOString();
            const state = ensureSectionState(section.id, now);
            assertCanEdit(state, actor, now);
            assertExpectedState(state, req.body);

            const sourceCommit = getCommitForSection(section.id, restoreCommitId);
            if (!sourceCommit) {
                throw createHttpError("Commit not found", 404);
            }

            const commit = insertCommit({
                section,
                state,
                snapshotJson: sourceCommit.snapshot_json,
                snapshotHash: sourceCommit.snapshot_hash || hashString(sourceCommit.snapshot_json),
                kind: "restore",
                restoredFromCommitId: sourceCommit.id,
                actor,
                title: normalizeOptionalString(req.body?.title) || `Restore #${sourceCommit.commit_no}`,
                note: normalizeOptionalString(req.body?.note),
                now,
            });

            const nextState = setHeadCommit(section.id, commit.id, now);
            return { commit, state: nextState };
        })();

        res.status(201).json({
            commit: normalizeCommitRow(result.commit, true),
            state: normalizeStateRow(result.state),
        });
    } catch (err) {
        handleRouteError(res, err, "Restore section failed");
    }
});

router.post("/:sectionId/submit", (req, res) => {
    const section = getSectionById(req.params.sectionId);
    if (!section) {
        return res.status(404).json({ error: "Section not found" });
    }

    const actor = normalizeActor(req.body?.submitted_by || req.body?.user_id || req.get("x-user-id"));
    if (!actor) {
        return res.status(400).json({ error: "submitted_by is required" });
    }

    try {
        const submission = db.transaction(() => {
            const now = new Date().toISOString();
            const state = ensureSectionState(section.id, now);
            assertLockAvailable(state, actor, now);
            if (state.status !== "editing") {
                throw createHttpError("Section is not editable", 409);
            }

            const commitId = normalizeId(req.body?.commit_id) || state.head_commit_id;
            if (!commitId) {
                throw createHttpError("Section has no commit to submit", 400);
            }

            const commit = getCommitForSection(section.id, commitId);
            if (!commit) {
                throw createHttpError("Commit not found", 404);
            }

            const id = crypto.randomUUID();
            db.prepare(`
                INSERT INTO section_submissions (
                    id, section_id, commit_id, submitted_by, submitted_at, status,
                    snapshot_json, snapshot_hash
                )
                VALUES (?, ?, ?, ?, ?, 'pending', ?, ?)
            `).run(
                id,
                section.id,
                commit.id,
                actor,
                now,
                commit.snapshot_json,
                commit.snapshot_hash || hashString(commit.snapshot_json)
            );

            db.prepare(`
                UPDATE section_states
                SET status = 'submitted',
                    locked_by = NULL,
                    locked_at = NULL,
                    lock_expires_at = NULL,
                    updated_at = ?
                WHERE section_id = ?
            `).run(now, section.id);

            return getSubmissionById(id);
        })();

        res.status(201).json(normalizeSubmissionRow(submission, true));
    } catch (err) {
        handleRouteError(res, err, "Submit section failed");
    }
});

router.get("/:sectionId/submissions", (req, res) => {
    const section = getSectionById(req.params.sectionId);
    if (!section) {
        return res.status(404).json({ error: "Section not found" });
    }

    const includeSnapshot = req.query.include_snapshot === "1" || req.query.include_snapshot === "true";
    const rows = db.prepare(`
        SELECT *
        FROM section_submissions
        WHERE section_id = ?
        ORDER BY submitted_at DESC
    `).all(section.id);

    res.json(rows.map((row) => normalizeSubmissionRow(row, includeSnapshot)));
});

router.post("/submissions/:submissionId/approve", (req, res) => {
    reviewSubmission(req, res, "approve");
});

router.post("/submissions/:submissionId/reject", (req, res) => {
    reviewSubmission(req, res, "reject");
});

function reviewSubmission(req, res, action) {
    const actor = normalizeActor(req.body?.reviewed_by || req.body?.user_id || req.get("x-user-id"));
    if (!actor) {
        return res.status(400).json({ error: "reviewed_by is required" });
    }

    try {
        const result = db.transaction(() => {
            const submission = getSubmissionById(req.params.submissionId);
            if (!submission) {
                throw createHttpError("Submission not found", 404);
            }
            if (submission.status !== "pending") {
                throw createHttpError("Submission is not pending", 409);
            }

            const now = new Date().toISOString();
            const reviewNote = normalizeOptionalString(req.body?.review_note);

            if (action === "reject") {
                updateSubmissionReview(submission.id, "rejected", actor, now, reviewNote);
                db.prepare(`
                    UPDATE section_states
                    SET status = 'rejected',
                        updated_at = ?
                    WHERE section_id = ?
                `).run(now, submission.section_id);
                return { submission: getSubmissionById(submission.id) };
            }

            const expectedHash = submission.snapshot_hash;
            if (expectedHash && expectedHash !== hashString(submission.snapshot_json)) {
                throw createHttpError("Submission snapshot hash mismatch", 409);
            }

            const snapshot = parseSnapshotJson(submission.snapshot_json);
            applySnapshotToPublished(snapshot, now);
            updateSubmissionReview(submission.id, "approved", actor, now, reviewNote);
            db.prepare(`
                UPDATE section_states
                SET status = 'approved',
                    updated_at = ?
                WHERE section_id = ?
            `).run(now, submission.section_id);

            return { submission: getSubmissionById(submission.id) };
        })();

        res.json(normalizeSubmissionRow(result.submission, true));
    } catch (err) {
        if (err && err.isConflict && req.params.submissionId) {
            const now = new Date().toISOString();
            db.prepare(`
                UPDATE section_submissions
                SET status = 'conflicted',
                    reviewed_by = ?,
                    reviewed_at = ?,
                    review_note = ?
                WHERE id = ?
                  AND status = 'pending'
            `).run(actor, now, err.message, req.params.submissionId);
        }
        handleRouteError(res, err, "Review submission failed");
    }
}

function insertCommit(options) {
    const nextNo = getNextCommitNo(options.section.id);
    const id = crypto.randomUUID();
    db.prepare(`
        INSERT INTO section_commits (
            id, section_id, parent_commit_id, commit_no, kind, restored_from_commit_id,
            created_by, created_at, title, note, snapshot_json, snapshot_hash
        )
        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
    `).run(
        id,
        options.section.id,
        options.state.head_commit_id || null,
        nextNo,
        options.kind,
        options.restoredFromCommitId,
        options.actor,
        options.now,
        options.title,
        options.note,
        options.snapshotJson,
        options.snapshotHash
    );

    return getCommitForSection(options.section.id, id);
}

function applySnapshotToPublished(snapshot, now) {
    validateSnapshot(snapshot);
    const entities = Array.isArray(snapshot.entities) ? snapshot.entities : [];
    const geometries = Array.isArray(snapshot.geometries) ? snapshot.geometries : [];
    const linkScopes = Array.isArray(snapshot.link_scopes) ? snapshot.link_scopes : [];

    for (const entity of entities) {
        applyEntitySnapshot(entity, now);
    }

    for (const geometry of geometries) {
        applyGeometrySnapshot(geometry, now);
    }

    for (const scope of linkScopes) {
        applyLinkScopeSnapshot(scope, now);
    }
}

function applyEntitySnapshot(entity, now) {
    const operation = normalizeOperation(entity?.operation);
    if (operation === "reference") return;

    const id = normalizeId(entity?.id);
    if (!id) throw createHttpError("Entity id is required in snapshot", 400);

    if (operation === "create") {
        db.prepare(`
            INSERT INTO entities (
                id, name, slug, description, type_id, status, is_deleted, created_at, updated_at
            )
            VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
        `).run(
            id,
            normalizeRequiredString(entity.name),
            normalizeOptionalString(entity.slug),
            normalizeOptionalString(entity.description),
            normalizeTypeId(entity.type_id),
            normalizeInteger(entity.status, 1),
            normalizeInteger(entity.is_deleted, 0),
            now,
            now
        );
        return;
    }

    const existing = db.prepare(`SELECT * FROM entities WHERE id = ?`).get(id);
    assertBaseMatches("entity", id, existing, entity);

    if (operation === "delete") {
        db.prepare(`
            UPDATE entities
            SET is_deleted = 1,
                updated_at = ?
            WHERE id = ?
        `).run(now, id);
        db.prepare(`DELETE FROM entity_geometries WHERE entity_id = ?`).run(id);
        return;
    }

    db.prepare(`
        UPDATE entities
        SET name = ?,
            slug = ?,
            description = ?,
            type_id = ?,
            status = ?,
            is_deleted = ?,
            updated_at = ?
        WHERE id = ?
    `).run(
        normalizeRequiredString(entity.name),
        normalizeOptionalString(entity.slug),
        normalizeOptionalString(entity.description),
        normalizeTypeId(entity.type_id),
        normalizeInteger(entity.status, 1),
        normalizeInteger(entity.is_deleted, 0),
        now,
        id
    );
}

function applyGeometrySnapshot(geometry, now) {
    const operation = normalizeOperation(geometry?.operation);
    if (operation === "reference") return;

    const id = normalizeId(geometry?.id);
    if (!id) throw createHttpError("Geometry id is required in snapshot", 400);

    if (operation === "delete") {
        const existing = db.prepare(`SELECT * FROM geometries WHERE id = ?`).get(id);
        assertBaseMatches("geometry", id, existing, geometry);
        db.prepare(`
            UPDATE geometries
            SET is_deleted = 1,
                updated_at = ?
            WHERE id = ?
        `).run(now, id);
        db.prepare(`DELETE FROM entity_geometries WHERE geometry_id = ?`).run(id);
        removeBindingReferenceFromAll(id, now);
        return;
    }

    const drawGeometry = geometry.draw_geometry || geometry.geometry;
    if (!drawGeometry) {
        throw createHttpError("Geometry draw_geometry is required in snapshot", 400);
    }
    const temporalRange = normalizeTemporalRange(geometry.time_start, geometry.time_end);
    const bbox = normalizeBBox(geometry.bbox) || getBBox(drawGeometry);
    const binding = normalizeIdArray(geometry.binding).filter((bindingId) => bindingId !== id);

    if (operation === "create") {
        db.prepare(`
            INSERT INTO geometries (
                id, type, is_deleted, draw_geometry, binding, time_start, time_end,
                bbox_min_lng, bbox_min_lat, bbox_max_lng, bbox_max_lat, created_at, updated_at
            )
            VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
        `).run(
            id,
            normalizeOptionalString(geometry.type),
            normalizeInteger(geometry.is_deleted, 0),
            JSON.stringify(drawGeometry),
            serializeIdArray(binding),
            temporalRange.timeStart,
            temporalRange.timeEnd,
            bbox.minLng,
            bbox.minLat,
            bbox.maxLng,
            bbox.maxLat,
            now,
            now
        );
        return;
    }

    const existing = db.prepare(`SELECT * FROM geometries WHERE id = ?`).get(id);
    assertBaseMatches("geometry", id, existing, geometry);

    db.prepare(`
        UPDATE geometries
        SET type = ?,
            is_deleted = ?,
            draw_geometry = ?,
            binding = ?,
            time_start = ?,
            time_end = ?,
            bbox_min_lng = ?,
            bbox_min_lat = ?,
            bbox_max_lng = ?,
            bbox_max_lat = ?,
            updated_at = ?
        WHERE id = ?
    `).run(
        normalizeOptionalString(geometry.type),
        normalizeInteger(geometry.is_deleted, 0),
        JSON.stringify(drawGeometry),
        serializeIdArray(binding),
        temporalRange.timeStart,
        temporalRange.timeEnd,
        bbox.minLng,
        bbox.minLat,
        bbox.maxLng,
        bbox.maxLat,
        now,
        id
    );
}

function applyLinkScopeSnapshot(scope, now) {
    if (normalizeOperation(scope?.operation) === "reference") return;

    const geometryId = normalizeId(scope?.geometry_id);
    if (!geometryId) throw createHttpError("link_scope geometry_id is required", 400);

    const existing = db.prepare(`
        SELECT id
        FROM geometries
        WHERE id = ?
          AND is_deleted = 0
    `).get(geometryId);
    if (!existing) {
        throw createConflictError(`Geometry not found for link scope: ${geometryId}`);
    }

    const entityIds = normalizeIdArray(scope.entity_ids);
    if (!entityIds.length) {
        throw createHttpError("link_scope entity_ids must not be empty", 400);
    }

    if (scope.base_links_hash) {
        const currentHash = hashEntityLinks(geometryId);
        if (scope.base_links_hash !== currentHash) {
            throw createConflictError(`Links changed for geometry: ${geometryId}`);
        }
    }

    const placeholders = entityIds.map(() => "?").join(",");
    const rows = db.prepare(`
        SELECT id
        FROM entities
        WHERE is_deleted = 0
          AND id IN (${placeholders})
    `).all(...entityIds);
    const found = new Set(rows.map((row) => row.id));
    const missing = entityIds.filter((entityId) => !found.has(entityId));
    if (missing.length) {
        throw createHttpError(`Entity not found: ${missing.join(", ")}`, 400);
    }

    db.prepare(`DELETE FROM entity_geometries WHERE geometry_id = ?`).run(geometryId);
    for (const entityId of entityIds) {
        db.prepare(`
            INSERT INTO entity_geometries (entity_id, geometry_id, created_at)
            VALUES (?, ?, ?)
        `).run(entityId, geometryId, now);
    }
}

function validateSnapshot(snapshot) {
    if (!snapshot || typeof snapshot !== "object" || Array.isArray(snapshot)) {
        throw createHttpError("snapshot must be an object", 400);
    }

    const slugSet = new Set();
    for (const entity of Array.isArray(snapshot.entities) ? snapshot.entities : []) {
        const operation = normalizeOperation(entity?.operation);
        if (!operation) throw createHttpError("Invalid entity operation", 400);
        if (operation !== "delete" && operation !== "reference" && !normalizeRequiredString(entity?.name)) {
            throw createHttpError("Entity name is required", 400);
        }
        const slug = normalizeOptionalString(entity?.slug);
        if (slug) {
            const key = slug.toLowerCase();
            if (slugSet.has(key)) throw createHttpError(`Duplicate slug in snapshot: ${slug}`, 400);
            slugSet.add(key);
        }
    }

    for (const geometry of Array.isArray(snapshot.geometries) ? snapshot.geometries : []) {
        const operation = normalizeOperation(geometry?.operation);
        if (!operation) throw createHttpError("Invalid geometry operation", 400);
        if (operation === "delete" || operation === "reference") continue;

        normalizeTemporalRange(geometry?.time_start, geometry?.time_end);
        const bbox = normalizeBBox(geometry?.bbox);
        if (geometry?.bbox && !bbox) throw createHttpError("Invalid geometry bbox", 400);
        const binding = normalizeIdArray(geometry?.binding);
        if (binding.includes(normalizeId(geometry?.id))) {
            throw createHttpError("binding cannot contain self id", 400);
        }
    }

    for (const scope of Array.isArray(snapshot.link_scopes) ? snapshot.link_scopes : []) {
        const entityIds = normalizeIdArray(scope?.entity_ids);
        if (!entityIds.length) {
            throw createHttpError("link_scope entity_ids must not be empty", 400);
        }
    }
}

function assertBaseMatches(kind, id, existing, snapshotItem) {
    if (!existing) {
        throw createConflictError(`${kind} not found: ${id}`);
    }
    if (snapshotItem.base_updated_at && existing.updated_at !== snapshotItem.base_updated_at) {
        throw createConflictError(`${kind} changed: ${id}`);
    }
    if (snapshotItem.base_hash) {
        const currentHash = kind === "entity" ? hashEntityRow(existing) : hashGeometryRow(existing);
        if (snapshotItem.base_hash !== currentHash) {
            throw createConflictError(`${kind} changed: ${id}`);
        }
    }
}

function getSectionById(sectionId) {
    const row = db.prepare(`
        SELECT
            s.*,
            st.status,
            st.head_commit_id,
            st.version,
            st.locked_by,
            st.locked_at,
            st.lock_expires_at
        FROM sections s
        LEFT JOIN section_states st
          ON st.section_id = s.id
        WHERE s.id = ?
    `).get(sectionId);

    return row ? normalizeSectionRow(row) : null;
}

function ensureSectionState(sectionId, now) {
    let row = db.prepare(`SELECT * FROM section_states WHERE section_id = ?`).get(sectionId);
    if (row) return row;

    db.prepare(`
        INSERT INTO section_states (section_id, status, version, updated_at)
        VALUES (?, 'editing', 0, ?)
    `).run(sectionId, now);

    return db.prepare(`SELECT * FROM section_states WHERE section_id = ?`).get(sectionId);
}

function acquireLock(sectionId, actor, now) {
    db.prepare(`
        UPDATE section_states
        SET locked_by = ?,
            locked_at = ?,
            lock_expires_at = ?,
            updated_at = ?
        WHERE section_id = ?
    `).run(actor, now, new Date(Date.parse(now) + LOCK_TTL_MS).toISOString(), now, sectionId);

    return db.prepare(`SELECT * FROM section_states WHERE section_id = ?`).get(sectionId);
}

function assertCanEdit(state, actor, now) {
    if (state.status !== "editing" && state.status !== "rejected") {
        throw createHttpError("Section is not editable", 409);
    }
    assertLockAvailable(state, actor, now);
}

function assertLockAvailable(state, actor, now) {
    if (!state.locked_by) return;
    if (actor && state.locked_by === actor) return;
    if (state.lock_expires_at && Date.parse(state.lock_expires_at) <= Date.parse(now)) return;
    throw createHttpError("Section is locked by another user", 409);
}

function assertExpectedState(state, body) {
    if (body?.expected_version !== undefined && Number(body.expected_version) !== Number(state.version)) {
        throw createHttpError("Section version changed", 409);
    }
    if (
        body?.expected_head_commit_id !== undefined &&
        normalizeId(body.expected_head_commit_id) !== (state.head_commit_id || null)
    ) {
        throw createHttpError("Section head commit changed", 409);
    }
}

function setHeadCommit(sectionId, commitId, now) {
    db.prepare(`
        UPDATE section_states
        SET status = 'editing',
            head_commit_id = ?,
            version = version + 1,
            updated_at = ?
        WHERE section_id = ?
    `).run(commitId, now, sectionId);

    db.prepare(`UPDATE sections SET updated_at = ? WHERE id = ?`).run(now, sectionId);
    return db.prepare(`SELECT * FROM section_states WHERE section_id = ?`).get(sectionId);
}

function getNextCommitNo(sectionId) {
    const row = db.prepare(`
        SELECT COALESCE(MAX(commit_no), 0) + 1 AS next_no
        FROM section_commits
        WHERE section_id = ?
    `).get(sectionId);
    return Number(row?.next_no || 1);
}

function getCommitForSection(sectionId, commitId) {
    return db.prepare(`
        SELECT *
        FROM section_commits
        WHERE section_id = ?
          AND id = ?
    `).get(sectionId, commitId);
}

function getSubmissionById(submissionId) {
    return db.prepare(`SELECT * FROM section_submissions WHERE id = ?`).get(submissionId);
}

function updateSubmissionReview(submissionId, status, actor, now, reviewNote) {
    db.prepare(`
        UPDATE section_submissions
        SET status = ?,
            reviewed_by = ?,
            reviewed_at = ?,
            review_note = ?
        WHERE id = ?
    `).run(status, actor, now, reviewNote, submissionId);
}

function normalizeSectionRow(row) {
    return {
        id: row.id,
        title: row.title,
        description: row.description,
        user_id: row.user_id || null,
        created_by: row.created_by,
        created_at: row.created_at,
        updated_at: row.updated_at,
        state: {
            status: row.status || "editing",
            head_commit_id: row.head_commit_id || null,
            version: Number(row.version || 0),
            locked_by: row.locked_by || null,
            locked_at: row.locked_at || null,
            lock_expires_at: row.lock_expires_at || null,
        },
    };
}

function normalizeStateRow(row) {
    return {
        section_id: row.section_id,
        status: row.status,
        head_commit_id: row.head_commit_id || null,
        version: Number(row.version || 0),
        locked_by: row.locked_by || null,
        locked_at: row.locked_at || null,
        lock_expires_at: row.lock_expires_at || null,
        updated_at: row.updated_at,
    };
}

function normalizeCommitRow(row, includeSnapshot) {
    const out = {
        id: row.id,
        section_id: row.section_id,
        parent_commit_id: row.parent_commit_id || null,
        commit_no: Number(row.commit_no),
        kind: row.kind,
        restored_from_commit_id: row.restored_from_commit_id || null,
        created_by: row.created_by,
        created_at: row.created_at,
        title: row.title,
        note: row.note,
        snapshot_hash: row.snapshot_hash,
    };
    if (includeSnapshot) out.snapshot = parseSnapshotJson(row.snapshot_json);
    return out;
}

function normalizeSubmissionRow(row, includeSnapshot) {
    const out = {
        id: row.id,
        section_id: row.section_id,
        commit_id: row.commit_id,
        submitted_by: row.submitted_by,
        submitted_at: row.submitted_at,
        status: row.status,
        reviewed_by: row.reviewed_by || null,
        reviewed_at: row.reviewed_at || null,
        review_note: row.review_note || null,
        snapshot_hash: row.snapshot_hash,
    };
    if (includeSnapshot) out.snapshot = parseSnapshotJson(row.snapshot_json);
    return out;
}

function buildEmptySnapshot(section) {
    return {
        schema_version: 1,
        section: {
            id: section.id,
            title: section.title,
        },
        entities: [],
        geometries: [],
        link_scopes: [],
    };
}

function normalizeSnapshotInput(input) {
    if (typeof input === "string") {
        try {
            const snapshot = JSON.parse(input);
            return { snapshot, snapshotJson: JSON.stringify(snapshot) };
        } catch (_err) {
            return { error: "snapshot_json must be valid JSON" };
        }
    }
    if (input && typeof input === "object" && !Array.isArray(input)) {
        return { snapshot: input, snapshotJson: JSON.stringify(input) };
    }
    return { error: "snapshot is required" };
}

function parseSnapshotJson(value) {
    try {
        return JSON.parse(value);
    } catch (_err) {
        return null;
    }
}

function normalizeOperation(value) {
    const normalized = String(value || "").trim().toLowerCase();
    if (["create", "update", "delete", "reference", "replace"].includes(normalized)) {
        return normalized === "replace" ? "update" : normalized;
    }
    return null;
}

function normalizeTemporalRange(timeStartValue, timeEndValue) {
    const timeStart = normalizeOptionalInteger(timeStartValue);
    const timeEnd = normalizeOptionalInteger(timeEndValue);
    if (timeStart !== null && timeEnd !== null && timeStart > timeEnd) {
        throw createHttpError("time_start must be <= time_end", 400);
    }
    return { timeStart, timeEnd };
}

function normalizeBBox(value) {
    if (!value || typeof value !== "object") return null;
    const minLng = Number(value.min_lng ?? value.minLng);
    const minLat = Number(value.min_lat ?? value.minLat);
    const maxLng = Number(value.max_lng ?? value.maxLng);
    const maxLat = Number(value.max_lat ?? value.maxLat);
    if (![minLng, minLat, maxLng, maxLat].every(Number.isFinite)) return null;
    if (minLng > maxLng || minLat > maxLat) return null;
    return { minLng, minLat, maxLng, maxLat };
}

function normalizeIdArray(value) {
    if (value === undefined || value === null || value === "") return [];
    if (!Array.isArray(value)) throw createHttpError("Expected an array of ids", 400);
    const seen = new Set();
    const ids = [];
    for (const item of value) {
        const id = normalizeId(item);
        if (!id || seen.has(id)) continue;
        seen.add(id);
        ids.push(id);
    }
    return ids;
}

function serializeIdArray(value) {
    return value.length ? JSON.stringify(value) : null;
}

function removeBindingReferenceFromAll(removedGeometryId, now) {
    const removedId = String(removedGeometryId);
    const rows = db.prepare(`
        SELECT id, binding
        FROM geometries
        WHERE is_deleted = 0
          AND binding IS NOT NULL
          AND binding != ''
    `).all();

    for (const row of rows) {
        let binding;
        try {
            binding = JSON.parse(row.binding);
        } catch (_err) {
            binding = [];
        }
        const next = normalizeIdArray(binding).filter((id) => id !== removedId);
        if (next.length === binding.length) continue;
        db.prepare(`
            UPDATE geometries
            SET binding = ?,
                updated_at = ?
            WHERE id = ?
        `).run(serializeIdArray(next), now, row.id);
    }
}

function hashEntityLinks(geometryId) {
    const rows = db.prepare(`
        SELECT entity_id
        FROM entity_geometries
        WHERE geometry_id = ?
        ORDER BY entity_id ASC
    `).all(geometryId);
    return hashObject(rows.map((row) => row.entity_id));
}

function hashEntityRow(row) {
    return hashObject({
        id: row.id,
        name: row.name,
        slug: row.slug,
        description: row.description,
        type_id: row.type_id,
        status: row.status,
        is_deleted: row.is_deleted,
    });
}

function hashGeometryRow(row) {
    return hashObject({
        id: row.id,
        type: row.type,
        is_deleted: row.is_deleted,
        draw_geometry: row.draw_geometry,
        binding: row.binding,
        time_start: row.time_start,
        time_end: row.time_end,
        bbox_min_lng: row.bbox_min_lng,
        bbox_min_lat: row.bbox_min_lat,
        bbox_max_lng: row.bbox_max_lng,
        bbox_max_lat: row.bbox_max_lat,
    });
}

function hashObject(value) {
    return hashString(JSON.stringify(value));
}

function hashString(value) {
    return `sha256:${crypto.createHash("sha256").update(value).digest("hex")}`;
}

function normalizeActor(value) {
    return normalizeId(value) || "anonymous";
}

function normalizeId(value) {
    if (value === undefined || value === null || value === "") return null;
    const normalized = String(value).trim();
    return normalized || null;
}

function normalizeRequiredString(value) {
    if (typeof value !== "string") return null;
    const trimmed = value.trim();
    return trimmed.length ? trimmed : null;
}

function normalizeOptionalString(value) {
    if (value === undefined || value === null) return null;
    if (typeof value !== "string") return null;
    const trimmed = value.trim();
    return trimmed.length ? trimmed : null;
}

function normalizeOptionalInteger(value) {
    if (value === undefined || value === null || value === "") return null;
    const num = Number(value);
    if (!Number.isFinite(num)) throw createHttpError("Expected a number", 400);
    return Math.trunc(num);
}

function normalizeInteger(value, fallback) {
    if (value === undefined || value === null || value === "") return fallback;
    const num = Number(value);
    return Number.isFinite(num) ? Math.trunc(num) : fallback;
}

function normalizeTypeId(value) {
    const normalized = normalizeOptionalString(value);
    return normalized ? normalized.toLowerCase() : "country";
}

function isSqliteConstraint(err) {
    const code = err?.code || "";
    return code === "SQLITE_CONSTRAINT" || String(code).startsWith("SQLITE_CONSTRAINT_");
}

function createHttpError(message, status = 400) {
    const err = new Error(message);
    err.status = status;
    return err;
}

function createConflictError(message) {
    const err = createHttpError(message, 409);
    err.isConflict = true;
    return err;
}

function handleRouteError(res, err, fallbackMessage) {
    if (err.status) {
        return res.status(err.status).json({ error: err.message });
    }
    if (isSqliteConstraint(err)) {
        return res.status(409).json({ error: "Database constraint failed" });
    }
    console.error(fallbackMessage, err);
    return res.status(500).json({ error: fallbackMessage });
}

module.exports = router;