import { NextResponse } from "next/server";
import { z } from "zod";
import { auth } from "@/auth";
import {
  returnAssignment,
  transferAssignment,
  validateReturnAssignmentInput,
  validateTransferAssignmentInput,
} from "@/lib/assignments";

// First dynamic-segment ([id]) route in the codebase — see
// docs/asset-license-management.md's "Assignment (chốt 2026-08-02)" section,
// bullet (b): update routes use PATCH /api/<entity>/[id], not an
// action-based sub-route (e.g. NOT /api/assignments/[id]/return). Next.js
// 14 App Router route handler params are a plain synchronous object (not a
// Promise) — that changed starting in Next.js 15, which this project does
// not use (see package.json / CLAUDE.md).
export async function PATCH(
  request: Request,
  { params }: { params: { id: string } }
): Promise<NextResponse> {
  const session = await auth();
  if (!session) {
    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
  }

  // Validate the [id] path segment's format up front — an invalid UUID
  // passed straight to Prisma's `findUnique({ where: { id } })` (a `@db.Uuid`
  // column) throws a raw PrismaClientKnownRequestError that
  // returnAssignment()'s try/catch doesn't specifically handle, which would
  // otherwise leak as an uncaught 500 instead of a clean 400.
  if (!z.string().uuid().safeParse(params.id).success) {
    return NextResponse.json({ error: "id must be a valid UUID string" }, { status: 400 });
  }

  let body: unknown;
  try {
    body = await request.json();
  } catch {
    return NextResponse.json({ error: "Request body must be valid JSON" }, { status: 400 });
  }

  if (typeof body !== "object" || body === null) {
    return NextResponse.json({ error: "Request body must be a JSON object" }, { status: 400 });
  }

  const { returnedAt, employeeId } = body as Record<string, unknown>;

  // Dispatch on body shape — a body carrying employeeId is a transfer
  // request, everything else is the existing return behavior. The two are
  // mutually exclusive: don't guess intent if a caller sends both (see
  // docs/asset-license-management.md's "Assignment (chốt 2026-08-02)"
  // section, bullet right after the transfer rule, for why this stays a
  // single PATCH route rather than an action-based sub-route).
  if (employeeId !== undefined && returnedAt !== undefined) {
    return NextResponse.json(
      { error: "Provide either employeeId (transfer) or returnedAt (return), not both" },
      { status: 400 }
    );
  }

  if (employeeId !== undefined) {
    const transferValidation = validateTransferAssignmentInput({ employeeId });
    if (!transferValidation.ok) {
      return NextResponse.json({ error: transferValidation.error }, { status: 400 });
    }

    const transferred = await transferAssignment(params.id, transferValidation.value);
    if (!transferred.ok) {
      return NextResponse.json({ error: transferred.error }, { status: transferred.status });
    }
    return NextResponse.json(transferred.value, { status: 200 });
  }

  const validation = validateReturnAssignmentInput({ returnedAt });

  if (!validation.ok) {
    return NextResponse.json({ error: validation.error }, { status: 400 });
  }

  const updated = await returnAssignment(params.id, validation.value);
  if (!updated.ok) {
    return NextResponse.json({ error: updated.error }, { status: updated.status });
  }
  return NextResponse.json(updated.value, { status: 200 });
}