export const dynamic = 'force-dynamic'

import { NextRequest, NextResponse } from 'next/server'
import { aliasedTable } from 'drizzle-orm'
import { getSession } from '@/lib/auth/get-session'
import { withUser } from '@/lib/db/with-user'
import { writeAuditLog } from '@/lib/db/audit'
import { incidentAddenda, users } from '@/lib/db/schema'
import { eq, asc } from 'drizzle-orm'

export async function GET(
  _request: NextRequest,
  { params }: { params: Promise<{ id: string }> }
) {
  const { id } = await params
  const session = await getSession()
  if (!session) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
  if (!['hse', 'admin', 'supervisor'].includes(session.role))
    return NextResponse.json({ error: 'Forbidden' }, { status: 403 })

  const authorAlias = aliasedTable(users, 'author_user')
  const data = await withUser(session.sub, async tx =>
    tx.select({
      id: incidentAddenda.id,
      body: incidentAddenda.body,
      createdAt: incidentAddenda.createdAt,
      authorName: authorAlias.name,
    })
    .from(incidentAddenda)
    .leftJoin(authorAlias, eq(incidentAddenda.author, authorAlias.id))
    .where(eq(incidentAddenda.incidentId, id))
    .orderBy(asc(incidentAddenda.createdAt))
  )

  return NextResponse.json(data.map(a => ({
    id: a.id, body: a.body, created_at: a.createdAt,
    author: { name: a.authorName },
  })))
}

export async function POST(
  request: NextRequest,
  { params }: { params: Promise<{ id: string }> }
) {
  const { id } = await params
  const session = await getSession()
  if (!session) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
  if (!['hse', 'admin', 'supervisor'].includes(session.role))
    return NextResponse.json({ error: 'Forbidden' }, { status: 403 })

  const body: { body?: string } = await request.json().catch(() => ({}))
  const text = (body.body ?? '').trim()
  if (!text) return NextResponse.json({ error: 'body required' }, { status: 422 })
  if (text.length > 5000)
    return NextResponse.json({ error: 'body must be 5000 characters or fewer' }, { status: 422 })

  let addendumId!: string
  await withUser(session.sub, async tx => {
    const [addendum] = await tx.insert(incidentAddenda).values({
      incidentId: id,
      author: session.sub,
      body: text,
    }).returning({ id: incidentAddenda.id })

    if (!addendum) throw new Error('Insert failed')
    addendumId = addendum.id

    await writeAuditLog(tx, 'incident_addenda', addendum.id, 'INSERT', {
      incident_id: id, author: session.sub, body: text,
    })
  })

  return NextResponse.json({ id: addendumId }, { status: 201 })
}