import { useQuery } from "@tanstack/react-query";
import { api } from "@/lib/api";
import { useAuth } from "@/context/AuthContext";
import { Button } from "@/components/ui/button";
import { Switch } from "@/components/ui/switch";
import { ToolCard, QueryError, useToolAction } from "./shared";

export function SecurityTools() {
  const sessions = useQuery({ queryKey: ["sessions"], queryFn: api.sessions.list });
  const privacy = useQuery({ queryKey: ["enhanced", "privacy"], queryFn: () => api.enhanced.get<{ hostedAi: boolean }>("privacy") });
  const action = useToolAction();
  const { logout, user } = useAuth();
  return <>
    <ToolCard title="Signed-in sessions">
      <QueryError error={sessions.error} />
      {sessions.isPending && <p>Loading sessions…</p>}
      {sessions.data?.map(s => <div key={s.id} className="flex items-center justify-between gap-3 border-b pb-2">
        <div className="min-w-0"><p className="text-sm truncate">{s.current ? "This browser" : s.label}</p><p className="text-xs text-muted-foreground">Expires {new Date(s.expiresAt).toLocaleString()}</p></div>
        <Button variant="outline" disabled={action.isPending} onClick={() => action.mutate(async () => { if (s.current) { logout(); return; } await api.sessions.revoke(s.id); })}>Sign out</Button>
      </div>)}
      <Button variant="outline" disabled={action.isPending || user?.isDemo} onClick={() => action.mutate(async () => { await api.sessions.revokeAll(); logout(); })}>Sign out all sessions</Button>
      <p className="text-xs text-muted-foreground">API keys remain active until you revoke them separately.</p>
    </ToolCard>
    <ToolCard title="AI privacy">
      <QueryError error={privacy.error} />
      <label className="flex items-center gap-3 text-sm"><Switch checked={privacy.data?.hostedAi ?? false} disabled={!privacy.data || action.isPending}
        onCheckedChange={hostedAi => action.mutate(() => api.enhanced.post("privacy", { hostedAi }))} />Allow hosted AI categorization</label>
      <p className="text-sm text-muted-foreground">Off by default. When enabled, transaction descriptions may be sent to the configured hosted AI provider, including when the local model is unavailable. Local categorization and your rules work without this permission.</p>
    </ToolCard>
  </>;
}