property-management-network/app/api/v1/webhooks/[id]/route.ts

import { NextResponse } from "next/server"
import { and, eq } from "drizzle-orm"
import { db } from "@/lib/db"
import { webhook_endpoints } from "@/lib/db/schema"
import { resolveApiRequest } from "@/lib/api-auth"
import { webhookEndpointSchema } from "@/lib/validations"
import { isWebhookEvent } from "@/lib/webhooks/events"
import { assertSafeWebhookUrl, WebhookUrlError } from "@/lib/webhooks/ssrf"

// Public REST API (v1) — read/update/delete a single webhook subscription.
// DELETE is what Zapier's REST-hook unsubscribe calls. Owner-scoped by id.

const unauthorized = () =>
  NextResponse.json({ error: { code: 401, message: "Unauthorized" } }, { status: 401 })
const forbidden = () =>
  NextResponse.json({ error: { code: 403, message: "Forbidden" } }, { status: 403 })
const notFound = () =>
  NextResponse.json({ error: { code: 404, message: "Not found" } }, { status: 404 })

// Fields returned to API consumers (never the signing secret).
const RETURN_COLUMNS = {
  id: webhook_endpoints.id,
  url: webhook_endpoints.url,
  description: webhook_endpoints.description,
  events: webhook_endpoints.events,
  status: webhook_endpoints.status,
  source: webhook_endpoints.source,
  created_at: webhook_endpoints.created_at,
}

export async function GET(request: Request, { params }: { params: Promise<{ id: string }> }) {
  const ctx = await resolveApiRequest(request)
  if (!ctx) return unauthorized()

  const { id } = await params
  const data = await db.query.webhook_endpoints.findFirst({
    where: and(eq(webhook_endpoints.id, id), eq(webhook_endpoints.user_id, ctx.ownerId)),
    columns: { secret: false },
  })
  if (!data) return notFound()
  return NextResponse.json({ data })
}

export async function PATCH(request: Request, { params }: { params: Promise<{ id: string }> }) {
  const ctx = await resolveApiRequest(request)
  if (!ctx) return unauthorized()
  if (!ctx.canWrite) return forbidden()

  const { id } = await params
  const body = (await request.json().catch(() => null)) as Record<string, unknown> | null

  const parsed = webhookEndpointSchema.partial().safeParse(body ?? {})
  if (!parsed.success) {
    return NextResponse.json(
      { error: { code: 400, message: parsed.error.flatten() } },
      { status: 400 }
    )
  }

  const patch: Partial<typeof webhook_endpoints.$inferInsert> = {}
  if (parsed.data.url !== undefined) {
    try {
      await assertSafeWebhookUrl(parsed.data.url)
    } catch (e) {
      return NextResponse.json(
        {
          error: {
            code: 400,
            message: e instanceof WebhookUrlError ? e.message : "Invalid webhook URL",
          },
        },
        { status: 400 }
      )
    }
    patch.url = parsed.data.url
  }
  if (parsed.data.events !== undefined) {
    patch.events = Array.from(new Set(parsed.data.events.filter(isWebhookEvent)))
  }
  if (parsed.data.description !== undefined) patch.description = parsed.data.description || null
  if (body?.status === "active" || body?.status === "disabled") patch.status = body.status

  const [data] = await db
    .update(webhook_endpoints)
    .set(patch)
    .where(and(eq(webhook_endpoints.id, id), eq(webhook_endpoints.user_id, ctx.ownerId)))
    .returning(RETURN_COLUMNS)

  if (!data) return notFound()
  return NextResponse.json({ data })
}

export async function DELETE(request: Request, { params }: { params: Promise<{ id: string }> }) {
  const ctx = await resolveApiRequest(request)
  if (!ctx) return unauthorized()
  if (!ctx.canWrite) return forbidden()

  const { id } = await params
  const [deleted] = await db
    .delete(webhook_endpoints)
    .where(and(eq(webhook_endpoints.id, id), eq(webhook_endpoints.user_id, ctx.ownerId)))
    .returning({ id: webhook_endpoints.id })

  if (!deleted) return notFound()
  return NextResponse.json({ data: { id: deleted.id, deleted: true } })
}