export const dynamic = 'force-dynamic'

import { NextRequest, NextResponse } from 'next/server'
import { createClient } from '@/lib/supabase/server'
import { getSession } from '@/lib/auth/get-session'
import { rowsToCsv } from '@/lib/csv'

export async function GET(request: NextRequest) {
  const session = await getSession()
  if (!session) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })

  const role = request.nextUrl.searchParams.get('role') ?? 'hse'

  const allowedRoles: Record<string, string[]> = {
    hse: ['hse', 'admin'],
    management: ['management', 'admin'],
  }

  if (!allowedRoles[role] || !allowedRoles[role].includes(session.role)) {
    return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
  }

  const supabase = await createClient()

  const { data: incidents } = await supabase
    .from('incidents')
    .select(`
      reference_no, incident_type, status, severity, reported_at, closed_at,
      injury_involved, medical_status, lost_days,
      sites (name), zones (name)
    `)
    .order('reported_at', { ascending: false })
    .limit(10000)

  const rows = incidents ?? []

  const headers = [
    'Reference', 'Type', 'Status', 'Severity', 'Site', 'Zone',
    'Reported At', 'Closed At', 'Injury Involved', 'Medical Status', 'Lost Days',
  ]

  const csvRows = rows.map(inc => {
    const siteName = (inc.sites as unknown as { name: string } | null)?.name ?? ''
    const zoneName = (inc.zones as unknown as { name: string } | null)?.name ?? ''
    return [
      inc.reference_no ?? '',
      inc.incident_type,
      inc.status,
      String(inc.severity ?? ''),
      siteName,
      zoneName,
      inc.reported_at ? new Date(inc.reported_at as string).toISOString().split('T')[0] : '',
      inc.closed_at ? new Date(inc.closed_at as string).toISOString().split('T')[0] : '',
      inc.injury_involved ? 'Yes' : 'No',
      inc.medical_status ?? '',
      String(inc.lost_days ?? ''),
    ]
  })

  const csv = rowsToCsv(headers, csvRows)
  const safeRole = role.replace(/[^a-z0-9]/gi, '')
  const filename = `incidents-${safeRole}-${new Date().toISOString().split('T')[0]}.csv`

  await supabase.rpc('write_audit_log', {
    p_table_name: 'incidents',
    p_record_id: session.sub,
    p_action: 'export_csv',
    p_new_value: { role, row_count: rows.length } as never,
  })

  return new NextResponse(csv, {
    status: 200,
    headers: {
      'Content-Type': 'text/csv; charset=utf-8',
      'Content-Disposition': `attachment; filename="${filename}"`,
    },
  })
}