ims/app/api/admin/sites/route.ts

export const dynamic = 'force-dynamic'

import { NextRequest, NextResponse } from 'next/server'
import { requireAdmin } from '@/lib/auth/require-admin'

export async function POST(request: NextRequest) {
  const { supabase, user } = await requireAdmin()
  if (!user) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })

  const body: { kind?: 'site' | 'zone'; name?: string; address?: string; site_id?: string } =
    await request.json().catch(() => ({}))
  const name = (body.name ?? '').trim()
  if (!name) return NextResponse.json({ error: 'name required' }, { status: 422 })

  if (body.kind === 'zone') {
    if (!body.site_id) return NextResponse.json({ error: 'site_id required for zone' }, { status: 422 })
    const { data: zone, error } = await supabase
      .from('zones')
      .insert({ site_id: body.site_id, name })
      .select('id, qr_code_token')
      .single()
    if (error || !zone) return NextResponse.json({ error: 'Insert failed' }, { status: 500 })

    await supabase.rpc('write_audit_log', {
      p_table_name: 'zones',
      p_record_id: zone.id,
      p_action: 'INSERT',
      p_new_value: { name, site_id: body.site_id },
    })
    return NextResponse.json({ id: zone.id, qr_code_token: zone.qr_code_token }, { status: 201 })
  }

  const { data: site, error } = await supabase
    .from('sites')
    .insert({ name, address: body.address ?? null })
    .select('id')
    .single()
  if (error || !site) return NextResponse.json({ error: 'Insert failed' }, { status: 500 })

  await supabase.rpc('write_audit_log', {
    p_table_name: 'sites',
    p_record_id: site.id,
    p_action: 'INSERT',
    p_new_value: { name, address: body.address ?? null },
  })
  return NextResponse.json({ id: site.id }, { status: 201 })
}

export async function PATCH(request: NextRequest) {
  const { supabase, user } = await requireAdmin()
  if (!user) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })

  const body: { kind?: 'site' | 'zone'; id?: string; active?: boolean } =
    await request.json().catch(() => ({}))
  if (!body.id) return NextResponse.json({ error: 'id required' }, { status: 422 })
  const table = body.kind === 'zone' ? 'zones' : 'sites'

  const { data: before } = await supabase.from(table).select('*').eq('id', body.id).single()
  const { error } = await supabase.from(table).update({ active: body.active }).eq('id', body.id)
  if (error) return NextResponse.json({ error: 'Update failed' }, { status: 500 })

  await supabase.rpc('write_audit_log', {
    p_table_name: table,
    p_record_id: body.id,
    p_action: 'admin_update',
    p_old_value: before,
    p_new_value: { active: body.active },
  })
  return NextResponse.json({ ok: true })
}

export async function DELETE(request: NextRequest) {
  const { supabase, user } = await requireAdmin()
  if (!user) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })

  const body: { kind?: 'site' | 'zone'; id?: string } = await request.json().catch(() => ({}))
  if (!body.id) return NextResponse.json({ error: 'id required' }, { status: 422 })
  const table = body.kind === 'zone' ? 'zones' : 'sites'
  const col = body.kind === 'zone' ? 'zone_id' : 'site_id'

  // Count referencing incidents for a clear, actionable error message
  const { count } = await supabase
    .from('incidents')
    .select('id', { count: 'exact', head: true })
    .eq(col, body.id)
  if ((count ?? 0) > 0)
    return NextResponse.json(
      { error: `Cannot delete — ${count} incident(s) reference this. Deactivate it instead.` },
      { status: 409 },
    )

  const { data: before } = await supabase.from(table).select('*').eq('id', body.id).single()
  const { error } = await supabase.from(table).delete().eq('id', body.id)
  if (error)
    return NextResponse.json(
      {
        error:
          error.code === '23503'
            ? 'Cannot delete — this is still referenced elsewhere. Deactivate it instead.'
            : 'Delete failed',
      },
      { status: error.code === '23503' ? 409 : 500 },
    )

  await supabase.rpc('write_audit_log', {
    p_table_name: table,
    p_record_id: body.id,
    p_action: 'DELETE',
    p_old_value: before,
  })
  return NextResponse.json({ ok: true })
}