import { NextResponse } from "next/server"
import { and, eq } from "drizzle-orm"
import { z } from "zod"
import { db } from "@/lib/db"
import { maintenance_requests } from "@/lib/db/schema"
import { maintenanceSchema } from "@/lib/validations"
import { ownsProperty, ownsUnit, ownsTenant } from "@/lib/db/ownership"
import { resolveApiRequest } from "@/lib/api-auth"
import { emitWebhookEvent } from "@/lib/webhooks/emit"

// Public REST API (v1) — update a single maintenance request. Bearer API-key
// auth. Owner-scoped by id; mirrors the internal PATCH schema.

const unauthorized = () =>
  NextResponse.json({ error: { code: 401, message: "Unauthorized" } }, { status: 401 })
const forbidden = () =>
  NextResponse.json({ error: { code: 403, message: "Forbidden" } }, { status: 403 })

const maintenancePatchSchema = maintenanceSchema.partial().extend({
  status: z.enum(["open", "in_progress", "resolved", "closed"]).optional(),
  resolution_notes: z.string().optional(),
  actual_cost: z.number().positive().optional(),
  resolved_at: z.string().optional(),
})

export async function PATCH(request: Request, { params }: { params: Promise<{ id: string }> }) {
  const ctx = await resolveApiRequest(request)
  if (!ctx) return unauthorized()
  if (!ctx.canWrite) return forbidden()

  const { id } = await params
  const body = await request.json().catch(() => null)
  const parsed = maintenancePatchSchema.safeParse(body)
  if (!parsed.success) {
    return NextResponse.json(
      { error: { code: 400, message: parsed.error.flatten() } },
      { status: 400 }
    )
  }

  // If any FK is being changed, ensure the caller owns the referenced rows.
  if (
    !(await ownsProperty(ctx.ownerId, parsed.data.property_id)) ||
    !(await ownsUnit(ctx.ownerId, parsed.data.unit_id)) ||
    !(await ownsTenant(ctx.ownerId, parsed.data.tenant_id))
  ) {
    return forbidden()
  }

  const updateData: Record<string, unknown> = { ...parsed.data }

  // Auto-stamp resolved_at when transitioning to resolved.
  if (parsed.data.status === "resolved" && !parsed.data.resolved_at) {
    updateData.resolved_at = new Date().toISOString()
  }

  const [data] = await db
    .update(maintenance_requests)
    .set(updateData)
    .where(and(eq(maintenance_requests.id, id), eq(maintenance_requests.user_id, ctx.ownerId)))
    .returning()

  if (!data) {
    return NextResponse.json({ error: { code: 404, message: "Not found" } }, { status: 404 })
  }

  if (parsed.data.status) {
    await emitWebhookEvent({
      ownerId: ctx.ownerId,
      event: "maintenance.updated",
      data: { maintenance: data },
    })
  }

  return NextResponse.json({ data })
}