export const dynamic = 'force-dynamic'

import { NextRequest, NextResponse } from 'next/server'
import { createClient } from '@/lib/supabase/server'

async function requireAdmin() {
  const supabase = await createClient()
  const { data: { user }, error } = await supabase.auth.getUser()
  if (error || !user) return { supabase, user: null }
  const { data: profile } = await supabase
    .from('users').select('role').eq('id', user.id).single()
  if (!profile || profile.role !== 'admin') return { supabase, user: null }
  return { supabase, user }
}

export async function POST(request: NextRequest) {
  const { supabase, user } = await requireAdmin()
  if (!user) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })

  const body: { kind?: 'site' | 'zone'; name?: string; address?: string; site_id?: string } =
    await request.json().catch(() => ({}))
  const name = (body.name ?? '').trim()
  if (!name) return NextResponse.json({ error: 'name required' }, { status: 422 })

  if (body.kind === 'zone') {
    if (!body.site_id) return NextResponse.json({ error: 'site_id required for zone' }, { status: 422 })
    const { data: zone, error } = await supabase
      .from('zones')
      .insert({ site_id: body.site_id, name })
      .select('id, qr_code_token')
      .single()
    if (error || !zone) return NextResponse.json({ error: 'Insert failed' }, { status: 500 })

    await supabase.rpc('write_audit_log', {
      p_table_name: 'zones',
      p_record_id: zone.id,
      p_action: 'INSERT',
      p_new_value: { name, site_id: body.site_id },
    })
    return NextResponse.json({ id: zone.id, qr_code_token: zone.qr_code_token }, { status: 201 })
  }

  const { data: site, error } = await supabase
    .from('sites')
    .insert({ name, address: body.address ?? null })
    .select('id')
    .single()
  if (error || !site) return NextResponse.json({ error: 'Insert failed' }, { status: 500 })

  await supabase.rpc('write_audit_log', {
    p_table_name: 'sites',
    p_record_id: site.id,
    p_action: 'INSERT',
    p_new_value: { name, address: body.address ?? null },
  })
  return NextResponse.json({ id: site.id }, { status: 201 })
}