import { NextResponse } from 'next/server'
import { createClient } from '@/lib/supabase/server'

export const dynamic = 'force-dynamic'

export async function GET(_req: Request, { params }: { params: Promise<{ id: string }> }) {
  const { id } = await params
  const supabase = await createClient()
  const { data, error: authError } = await supabase.auth.getUser()
  if (authError || !data?.user) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
  const user = data.user

  const { data: profile } = await supabase.from('users').select('role, site_id').eq('id', user.id).single()
  const role = profile?.role ?? ''

  const { data: incident, error } = await supabase
    .from('incidents')
    .select(`
      id, reference_no, incident_type, description, severity, status,
      injury_involved, asset_involved, medical_status, lost_days,
      reported_at, closed_at,
      sites (id, name),
      zones (id, name),
      reporter:users!reported_by (id, name, email),
      evidence_files (id, stage, file_url, file_type, uploaded_at)
    `)
    .eq('id', id)
    .eq('evidence_files.deleted', false)
    .single()

  if (error || !incident) {
    return NextResponse.json({ error: 'Not found' }, { status: 404 })
  }

  const reporter = incident.reporter as unknown as { id: string } | null
  const isOwner = reporter?.id === user.id
  const isSiteStaff = ['hse', 'supervisor', 'admin'].includes(role)
  if (!isOwner && !isSiteStaff) {
    return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
  }

  return NextResponse.json(incident)
}