import { NextRequest, NextResponse } from "next/server";
import { db } from "@/lib/db";
import { requirePageRole, resolveSchoolId, ApiError } from "@/lib/auth";
import { logAudit } from "@/lib/audit";
import { handleApiError } from "@/lib/api-helpers";

/** تعديل بيانات شركة */
export async function PATCH(req: NextRequest, ctx: { params: Promise<{ id: string }> }) {
  try {
    const user = await requirePageRole("finance", "ADMIN", "ACCOUNTANT", "SUPER_ADMIN");
    const schoolId = await resolveSchoolId(user, req.nextUrl.searchParams.get("schoolId"));
    const { id } = await ctx.params;
    const supplier = await db.supplier.findFirst({ where: { id, deletedAt: null, schoolId } });
    if (!supplier) throw new ApiError("الشركة غير موجودة", 404);

    const body = await req.json();
    const { name, phone, notes } = body as Record<string, string | undefined>;
    const data: { name?: string; phone?: string | null; notes?: string | null } = {};

    if (name !== undefined) {
      const trimmed = String(name).trim();
      if (trimmed.length < 2) throw new ApiError("اسم الشركة مطلوب", 400);
      const dup = await db.supplier.findFirst({
        where: { name: trimmed, deletedAt: null, id: { not: id }, schoolId },
      });
      if (dup) throw new ApiError("توجد شركة أخرى بهذا الاسم", 409);
      data.name = trimmed;
    }
    if (phone !== undefined) data.phone = String(phone).trim() || null;
    if (notes !== undefined) data.notes = String(notes).trim() || null;
    if (Object.keys(data).length === 0) throw new ApiError("لا توجد بيانات للتعديل", 400);

    const updated = await db.supplier.update({ where: { id }, data });
    await logAudit(user, {
      action: "UPDATE",
      entity: "Supplier",
      entityId: id,
      details: `تعديل بيانات الشركة: ${updated.name}`,
    });
    return NextResponse.json({ supplier: updated });
  } catch (err) {
    return handleApiError(err);
  }
}

/** حذف شركة (حذف منطقي — تبقى فواتيرها ودفعاتها في السجل) — مدير فقط */
export async function DELETE(req: NextRequest, ctx: { params: Promise<{ id: string }> }) {
  try {
    const user = await requirePageRole("finance", "ADMIN", "SUPER_ADMIN");
    const schoolId = await resolveSchoolId(user, req.nextUrl.searchParams.get("schoolId"));
    const { id } = await ctx.params;
    const supplier = await db.supplier.findFirst({ where: { id, deletedAt: null, schoolId } });
    if (!supplier) throw new ApiError("الشركة غير موجودة", 404);

    await db.supplier.update({ where: { id }, data: { deletedAt: new Date() } });
    await logAudit(user, {
      action: "DELETE",
      entity: "Supplier",
      entityId: id,
      details: `حذف الشركة ${supplier.name} — تبقى فواتيرها ودفعاتها في السجل والمصروفات`,
    });
    return NextResponse.json({ ok: true });
  } catch (err) {
    return handleApiError(err);
  }
}