ims/app/api/admin/trucks/route.ts

export const dynamic = 'force-dynamic'

import { NextRequest, NextResponse } from 'next/server'
import { requireAdmin } from '@/lib/auth/require-admin'
import { createClient } from '@/lib/supabase/server'

export async function POST(request: NextRequest) {
  const { session } = await requireAdmin()
  if (!session) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
  const supabase = await createClient()

  const body: { truck_no?: string; carrier?: string } = await request.json().catch(() => ({}))
  const truck_no = (body.truck_no ?? '').trim()
  if (!truck_no) return NextResponse.json({ error: 'truck_no required' }, { status: 422 })

  const { data: truck, error } = await supabase
    .from('trucks')
    .insert({ truck_no, carrier: (body.carrier ?? '').trim() || null })
    .select('id')
    .single()

  if (error || !truck)
    return NextResponse.json(
      { error: error?.code === '23505' ? 'Truck number already exists' : 'Insert failed' },
      { status: 400 },
    )

  await supabase.rpc('write_audit_log', {
    p_table_name: 'trucks',
    p_record_id: truck.id,
    p_action: 'INSERT',
    p_new_value: { truck_no, carrier: (body.carrier ?? '').trim() || null },
  })

  return NextResponse.json({ id: truck.id }, { status: 201 })
}

export async function PATCH(request: NextRequest) {
  const { session } = await requireAdmin()
  if (!session) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
  const supabase = await createClient()

  const body: { id?: string; active?: boolean } = await request.json().catch(() => ({}))
  if (!body.id) return NextResponse.json({ error: 'id required' }, { status: 422 })

  const { data: before } = await supabase.from('trucks').select('*').eq('id', body.id).single()
  const { error } = await supabase.from('trucks').update({ active: body.active }).eq('id', body.id)
  if (error) return NextResponse.json({ error: 'Update failed' }, { status: 500 })

  await supabase.rpc('write_audit_log', {
    p_table_name: 'trucks',
    p_record_id: body.id,
    p_action: 'admin_update',
    p_old_value: before,
    p_new_value: { active: body.active },
  })
  return NextResponse.json({ ok: true })
}

export async function DELETE(request: NextRequest) {
  const { session } = await requireAdmin()
  if (!session) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
  const supabase = await createClient()

  const body: { id?: string } = await request.json().catch(() => ({}))
  if (!body.id) return NextResponse.json({ error: 'id required' }, { status: 422 })

  const { count } = await supabase
    .from('incidents')
    .select('id', { count: 'exact', head: true })
    .eq('truck_id', body.id)
  if ((count ?? 0) > 0)
    return NextResponse.json(
      { error: `Cannot delete — ${count} incident(s) reference this truck. Deactivate it instead.` },
      { status: 409 },
    )

  const { data: before } = await supabase.from('trucks').select('*').eq('id', body.id).single()
  const { error } = await supabase.from('trucks').delete().eq('id', body.id)
  if (error)
    return NextResponse.json(
      {
        error:
          error.code === '23503'
            ? 'Cannot delete — this truck is still referenced elsewhere. Deactivate it instead.'
            : 'Delete failed',
      },
      { status: error.code === '23503' ? 409 : 500 },
    )

  await supabase.rpc('write_audit_log', {
    p_table_name: 'trucks',
    p_record_id: body.id,
    p_action: 'DELETE',
    p_old_value: before,
  })
  return NextResponse.json({ ok: true })
}