ims/app/api/notifications/route.ts

export const dynamic = 'force-dynamic'

import { NextRequest, NextResponse } from 'next/server'
import { createClient } from '@/lib/supabase/server'
import { getSession } from '@/lib/auth/get-session'

export async function GET() {
  const session = await getSession()
  if (!session) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })

  const supabase = await createClient()

  const { data: notifications, error } = await supabase
    .from('notifications_log')
    .select('id, title, link, incident_id, capa_id, sent_at, read_at')
    .eq('channel', 'in_app')
    .eq('recipient_user_id', session.sub)
    .order('sent_at', { ascending: false })
    .limit(20)

  if (error) return NextResponse.json({ error: 'Fetch failed' }, { status: 500 })

  const { count } = await supabase
    .from('notifications_log')
    .select('id', { count: 'exact', head: true })
    .eq('channel', 'in_app')
    .eq('recipient_user_id', session.sub)
    .is('read_at', null)

  return NextResponse.json({ notifications: notifications ?? [], unread: count ?? 0 })
}

export async function POST(request: NextRequest) {
  const session = await getSession()
  if (!session) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })

  const supabase = await createClient()

  const body: { ids?: string[]; all?: boolean } = await request.json().catch(() => ({}))

  let query = supabase
    .from('notifications_log')
    .update({ read_at: new Date().toISOString() })
    .eq('recipient_user_id', session.sub)
    .is('read_at', null)

  if (!body.all) {
    if (!Array.isArray(body.ids) || body.ids.length === 0)
      return NextResponse.json({ error: 'ids required unless all:true' }, { status: 422 })
    query = query.in('id', body.ids)
  }

  const { error } = await query
  if (error) return NextResponse.json({ error: 'Update failed' }, { status: 500 })
  return NextResponse.json({ ok: true })
}