ims/app/api/capa/[id]/route.ts

export const dynamic = 'force-dynamic'

import { NextRequest, NextResponse } from 'next/server'
import { createClient } from '@/lib/supabase/server'
import { createAdminClient } from '@/lib/supabase/admin'
import { getSession } from '@/lib/auth/get-session'

export async function GET(
  _: NextRequest,
  { params }: { params: Promise<{ id: string }> }
) {
  const { id } = await params
  const session = await getSession()
  if (!session) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })

  const supabase = await createClient()

  const { data, error } = await supabase
    .from('capa_actions')
    .select(`
      id, incident_id, root_cause_ref, description, owner_user_id, department,
      due_date, priority, status, completed_at, verified_by, verified_at, created_at,
      owner_notes,
      incidents (reference_no, incident_type),
      owner:users!owner_user_id (name, email)
    `)
    .eq('id', id)
    .single()

  if (error || !data) return NextResponse.json({ error: 'Not found' }, { status: 404 })

  const role = session.role
  const isOwner = data.owner_user_id === session.sub
  const canRead = ['hse', 'admin', 'supervisor'].includes(role) || isOwner
  if (!canRead) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })

  // Strip owner email for non-privileged roles — only name needed
  const result = ['hse', 'admin'].includes(role)
    ? data
    : { ...data, owner: { name: (data.owner as unknown as { name: string } | null)?.name ?? '' } }

  return NextResponse.json(result)
}

export async function PATCH(
  request: NextRequest,
  { params }: { params: Promise<{ id: string }> }
) {
  const { id } = await params
  const session = await getSession()
  if (!session) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })

  const supabase = await createClient()
  const role = session.role

  const { data: capa } = await supabase.from('capa_actions').select('owner_user_id, status').eq('id', id).single()
  const isOwner = capa?.owner_user_id === session.sub
  const canEdit = ['hse', 'admin'].includes(role) || isOwner
  if (!canEdit) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })

  const terminalStatuses = ['verified', 'closed']
  if (terminalStatuses.includes(capa?.status ?? '') && !['hse', 'admin'].includes(role)) {
    return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
  }

  const body = await request.json()

  // Only hse/admin can set privileged statuses
  const privilegedStatuses = ['verified', 'reopened', 'closed']
  if (body.status && privilegedStatuses.includes(body.status) && !['hse', 'admin'].includes(role)) {
    return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
  }

  const allowed = ['hse', 'admin'].includes(role)
    ? ['description', 'due_date', 'priority', 'status', 'department', 'root_cause_ref', 'owner_notes']
    : ['status', 'owner_notes']
  const update: Record<string, unknown> = {}
  for (const key of allowed) {
    if (key in body) update[key] = body[key]
  }

  if (body.status === 'pending_verification') {
    update.completed_at = new Date().toISOString()
  }

  let oldNotes: string | null = null
  if ('owner_notes' in update) {
    const { data: current } = await supabase.from('capa_actions').select('owner_notes').eq('id', id).single()
    oldNotes = (current as { owner_notes: string | null } | null)?.owner_notes ?? null
  }

  const admin = createAdminClient()
  const { error } = await admin
    .from('capa_actions')
    .update(update)
    .eq('id', id)

  if (error) return NextResponse.json({ error: 'Update failed' }, { status: 500 })

  await supabase.rpc('write_audit_log', {
    p_table_name: 'capa_actions',
    p_record_id: id,
    p_action: 'updated',
    p_old_value: oldNotes !== null ? { owner_notes: oldNotes } : undefined,
    p_new_value: update as Record<string, unknown>,
  })

  return NextResponse.json({ ok: true })
}