import { NextResponse } from "next/server";

import {
  getContratsFeed,
  createContratFeed,
  findForbiddenContractField,
} from "../../../server/contrats.server";
import {
  employeeScopeFromAccess,
  requirePermission,
} from "../../../lib/authorization";
import { contratListQuerySchema, contratCreateSchema } from "../../../validators/contrats";

export async function GET(request: Request) {
  const auth = await requirePermission(request, "contrats", "read");

  if (!auth.ok) return auth.response;
  const url = new URL(request.url);
  const parsed = contratListQuerySchema.safeParse({
    limit: url.searchParams.get("limit") ?? undefined,
    offset: url.searchParams.get("offset") ?? undefined,
  });

  if (!parsed.success) {
    return NextResponse.json(
      { message: "Invalid query parameters", issues: parsed.error.flatten() },
      { status: 400 },
    );
  }

  const data = await getContratsFeed(
    parsed.data.limit,
    parsed.data.offset,
    employeeScopeFromAccess(auth.access),
  );

  return NextResponse.json({
    message: "Contrats retrieved successfully",
    ...data,
  });
}

export async function POST(request: Request){
  const auth = await requirePermission(request, "contrats", "write");

  if (!auth.ok) return auth.response;
  let body: unknown

  try{
    body = await request.json();
  } catch {
    return NextResponse.json(
      {message: "Invalid JSON body"},
      {status: 400},
    );
  }
    const parsed =  contratCreateSchema.safeParse(body);

  if(!parsed.success){
     return NextResponse.json(
      { message: "Invalid body parameters", issues: parsed.error.flatten() },
      { status: 400 },
    );
  }

  const forbiddenField = findForbiddenContractField(
    parsed.data,
    employeeScopeFromAccess(auth.access),
  );

  if (forbiddenField) {
    return NextResponse.json(
      {
        message: `Valeur non autorisée pour le champ ${forbiddenField}.`,
        forbiddenField,
      },
      { status: 403 },
    );
  }

  const data = await createContratFeed(parsed.data);

  return NextResponse.json(
    {
      message: "Contrat created successfully",
      ...data,
    },
    {status: 201},
  );
}