import { NextResponse } from "next/server";
import { auth } from "@/auth";
import { createVendor, listVendors, validateCreateVendorInput } from "@/lib/vendors";

// Mirrors src/app/api/licenses/route.ts's pattern — middleware.ts excludes
// /api from route protection, so this checks the session itself. Flat
// permission model (CLAUDE.md): only "logged in or not", no role check.
export async function POST(request: Request): Promise<NextResponse> {
  const session = await auth();
  if (!session) {
    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
  }

  let body: unknown;
  try {
    body = await request.json();
  } catch {
    return NextResponse.json({ error: "Request body must be valid JSON" }, { status: 400 });
  }

  if (typeof body !== "object" || body === null) {
    return NextResponse.json({ error: "Request body must be a JSON object" }, { status: 400 });
  }

  const { name, contactEmail, contactPhone, address, taxCode, notes } =
    body as Record<string, unknown>;
  const validation = validateCreateVendorInput({
    name,
    contactEmail,
    contactPhone,
    address,
    taxCode,
    notes,
  });

  if (!validation.ok) {
    return NextResponse.json({ error: validation.error }, { status: 400 });
  }

  const created = await createVendor(validation.value);
  return NextResponse.json(created, { status: 201 });
}

export async function GET(): Promise<NextResponse> {
  const session = await auth();
  if (!session) {
    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
  }

  const vendors = await listVendors();
  return NextResponse.json(vendors, { status: 200 });
}