import { NextResponse } from "next/server"
import { and, eq } from "drizzle-orm"
import { randomUUID } from "crypto"
import { db } from "@/lib/db"
import { tenants } from "@/lib/db/schema"
import { getSessionUser } from "@/lib/session"
import { getAccountContext } from "@/lib/account"

// Lets a landlord rotate a tenant's portal token (invalidates the old private link).
export async function POST(_: Request, { params }: { params: Promise<{ id: string }> }) {
  const user = await getSessionUser()
  if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })

  const ctx = await getAccountContext(user.id)
  if (!ctx.canWrite) return NextResponse.json({ error: "Forbidden" }, { status: 403 })

  const { id } = await params
  const [row] = await db
    .update(tenants)
    .set({ portal_token: randomUUID() })
    .where(and(eq(tenants.id, id), eq(tenants.user_id, ctx.ownerId)))
    .returning({ id: tenants.id, portal_token: tenants.portal_token })

  if (!row) return NextResponse.json({ error: "Not found" }, { status: 404 })
  return NextResponse.json({ portal_token: row.portal_token })
}