ims/app/api/admin/sites/route.ts

export const dynamic = 'force-dynamic'

import { NextRequest, NextResponse } from 'next/server'
import { requireAdmin } from '@/lib/auth/require-admin'
import { asAdmin } from '@/lib/db/with-user'
import { sites, zones, incidents } from '@/lib/db/schema'
import { writeAuditLog } from '@/lib/db/audit'
import { eq, sql } from 'drizzle-orm'

export async function POST(request: NextRequest) {
  const { session } = await requireAdmin()
  if (!session) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })

  const body: { kind?: 'site' | 'zone'; name?: string; address?: string; site_id?: string } =
    await request.json().catch(() => ({}))
  const name = (body.name ?? '').trim()
  if (!name) return NextResponse.json({ error: 'name required' }, { status: 422 })

  if (body.kind === 'zone') {
    if (!body.site_id) return NextResponse.json({ error: 'site_id required for zone' }, { status: 422 })
    const qrCodeToken = crypto.randomUUID()
    try {
      let zone: { id: string; qrCodeToken: string } | undefined
      await asAdmin(async db => {
        await db.transaction(async tx => {
          await tx.execute(sql`SELECT set_config('app.user_id', ${session.sub}, true)`)
          const [result] = await tx.insert(zones).values({ siteId: body.site_id!, name, qrCodeToken }).returning({ id: zones.id, qrCodeToken: zones.qrCodeToken })
          if (!result) throw new Error('Insert failed')
          zone = result
          await writeAuditLog(tx, 'zones', result.id, 'INSERT', { name, site_id: body.site_id })
        })
      })
      if (!zone) return NextResponse.json({ error: 'Insert failed' }, { status: 500 })
      return NextResponse.json({ id: zone.id, qr_code_token: zone.qrCodeToken }, { status: 201 })
    } catch {
      return NextResponse.json({ error: 'Insert failed' }, { status: 500 })
    }
  }

  try {
    let siteId: string | undefined
    await asAdmin(async db => {
      await db.transaction(async tx => {
        await tx.execute(sql`SELECT set_config('app.user_id', ${session.sub}, true)`)
        const [site] = await tx.insert(sites).values({ name, address: body.address ?? null }).returning({ id: sites.id })
        if (!site) throw new Error('Insert failed')
        siteId = site.id
        await writeAuditLog(tx, 'sites', site.id, 'INSERT', { name, address: body.address ?? null })
      })
    })
    if (!siteId) return NextResponse.json({ error: 'Insert failed' }, { status: 500 })
    return NextResponse.json({ id: siteId }, { status: 201 })
  } catch {
    return NextResponse.json({ error: 'Insert failed' }, { status: 500 })
  }
}

export async function PATCH(request: NextRequest) {
  const { session } = await requireAdmin()
  if (!session) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })

  const body: { kind?: 'site' | 'zone'; id?: string; active?: boolean } =
    await request.json().catch(() => ({}))
  if (!body.id) return NextResponse.json({ error: 'id required' }, { status: 422 })

  const table = body.kind === 'zone' ? zones : sites
  const [before] = await asAdmin(db =>
    db.select().from(table).where(eq(table.id, body.id!)).limit(1)
  )
  const tableName = body.kind === 'zone' ? 'zones' : 'sites'
  try {
    await asAdmin(async db => {
      await db.transaction(async tx => {
        await tx.execute(sql`SELECT set_config('app.user_id', ${session.sub}, true)`)
        await tx.update(table).set({ active: body.active }).where(eq(table.id, body.id!))
        await writeAuditLog(tx, tableName, body.id!, 'admin_update', { active: body.active }, before ?? null)
      })
    })
  } catch {
    return NextResponse.json({ error: 'Update failed' }, { status: 500 })
  }
  return NextResponse.json({ ok: true })
}

export async function DELETE(request: NextRequest) {
  const { session } = await requireAdmin()
  if (!session) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })

  const body: { kind?: 'site' | 'zone'; id?: string } = await request.json().catch(() => ({}))
  if (!body.id) return NextResponse.json({ error: 'id required' }, { status: 422 })

  const tableName = body.kind === 'zone' ? 'zones' : 'sites'
  const [countRow] = await asAdmin(db =>
    db.select({ cnt: sql<number>`count(*)` })
      .from(incidents)
      .where(body.kind === 'zone' ? eq(incidents.zoneId, body.id!) : eq(incidents.siteId, body.id!))
  )
  const incidentCount = Number(countRow?.cnt ?? 0)
  if (incidentCount > 0)
    return NextResponse.json(
      { error: `Cannot delete — ${incidentCount} incident(s) reference this. Deactivate it instead.` },
      { status: 409 },
    )

  const [before] = await asAdmin(db =>
    db.select().from(body.kind === 'zone' ? zones : sites).where(eq((body.kind === 'zone' ? zones : sites).id, body.id!)).limit(1)
  )
  try {
    await asAdmin(async db => {
      await db.transaction(async tx => {
        await tx.execute(sql`SELECT set_config('app.user_id', ${session.sub}, true)`)
        await tx.delete(body.kind === 'zone' ? zones : sites).where(eq((body.kind === 'zone' ? zones : sites).id, body.id!))
        await writeAuditLog(tx, tableName, body.id!, 'DELETE', null, before ?? null)
      })
    })
  } catch (e) {
    const code = (e as { code?: string }).code
    return NextResponse.json(
      { error: code === '23503' ? 'Cannot delete — still referenced elsewhere. Deactivate instead.' : 'Delete failed' },
      { status: code === '23503' ? 409 : 500 },
    )
  }
  return NextResponse.json({ ok: true })
}