property-management-network/app/api/documents/route.ts

import { NextResponse } from "next/server"
import { and, desc, eq } from "drizzle-orm"
import { db } from "@/lib/db"
import { documents, properties } from "@/lib/db/schema"
import { getSessionUser } from "@/lib/session"
import { saveFile } from "@/lib/storage"
import { ownsProperty, ownsTenant } from "@/lib/db/ownership"

export async function GET(request: Request) {
  const user = await getSessionUser()
  if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })

  const { searchParams } = new URL(request.url)
  const propertyId = searchParams.get("property_id")

  let propertyName = ""
  if (propertyId) {
    const prop = await db.query.properties.findFirst({
      where: and(eq(properties.id, propertyId), eq(properties.user_id, user.id)),
      columns: { name: true },
    })
    propertyName = prop?.name ?? ""
  }

  const data = await db.query.documents.findMany({
    where: and(
      eq(documents.user_id, user.id),
      propertyId ? eq(documents.property_id, propertyId) : undefined
    ),
    orderBy: desc(documents.created_at),
  })

  return NextResponse.json({ documents: data, propertyName })
}

export async function POST(request: Request) {
  const user = await getSessionUser()
  if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })

  const contentType = request.headers.get("content-type") ?? ""

  if (contentType.includes("multipart/form-data")) {
    const fd = await request.formData()
    const file = fd.get("file") as File | null
    const propertyId = fd.get("property_id") as string
    const name = fd.get("name") as string
    const category = ((fd.get("category") as string) || "other") as typeof documents.$inferInsert.category

    if (!file) return NextResponse.json({ error: "No file provided" }, { status: 400 })
    if (file.size > 20 * 1024 * 1024) return NextResponse.json({ error: "File too large (max 20 MB)" }, { status: 400 })

    // Verify the property belongs to the user before attaching a document to it.
    const prop = await db.query.properties.findFirst({
      where: and(eq(properties.id, propertyId), eq(properties.user_id, user.id)),
      columns: { id: true },
    })
    if (!prop) return NextResponse.json({ error: "Property not found" }, { status: 404 })

    const { key, size, type } = await saveFile(file, { userId: user.id, scope: "documents" })

    const [data] = await db
      .insert(documents)
      .values({
        user_id: user.id,
        property_id: propertyId,
        name: name || file.name,
        category,
        file_url: `/api/files/${key}`,
        storage_path: key,
        file_type: type,
        file_size: size,
      })
      .returning()

    return NextResponse.json(data, { status: 201 })
  }

  // JSON fallback (metadata only)
  const body = (await request.json()) as Record<string, unknown>
  const propertyId = body.property_id as string | undefined
  const tenantId = body.tenant_id as string | undefined

  // Verify the property/tenant belong to the user before attaching a document.
  if (!(await ownsProperty(user.id, propertyId))) {
    return NextResponse.json({ error: "Property not found" }, { status: 404 })
  }
  if (!(await ownsTenant(user.id, tenantId))) {
    return NextResponse.json({ error: "Tenant not found" }, { status: 404 })
  }

  // Whitelist insertable columns — never trust client-supplied user_id/id/created_at.
  const [data] = await db
    .insert(documents)
    .values({
      user_id: user.id,
      property_id: propertyId as string,
      tenant_id: tenantId,
      name: body.name as string,
      category: (body.category as typeof documents.$inferInsert.category) ?? "other",
      file_url: body.file_url as string,
      storage_path: body.storage_path as string | undefined,
      file_type: body.file_type as string | undefined,
      file_size: body.file_size as number | undefined,
    })
    .returning()

  return NextResponse.json(data, { status: 201 })
}