ubi-dan-itam/src/app/api/inventory-scans/[id]/route.ts

import { NextResponse } from "next/server";
import { z } from "zod";
import { auth } from "@/auth";
import {
  deleteInventoryScan,
  updateInventoryScan,
  validateUpdateInventoryScanInput,
} from "@/lib/inventory-scans";

// Review-page edit/delete — session-authed, mirrors
// src/app/api/assignments/[id]/route.ts's pattern (synchronous params,
// explicit UUID pre-check before hitting Prisma).
export async function PATCH(
  request: Request,
  { params }: { params: { id: string } }
): Promise<NextResponse> {
  const session = await auth();
  if (!session) {
    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
  }

  if (!z.string().uuid().safeParse(params.id).success) {
    return NextResponse.json({ error: "id must be a valid UUID string" }, { status: 400 });
  }

  let body: unknown;
  try {
    body = await request.json();
  } catch {
    return NextResponse.json({ error: "Request body must be valid JSON" }, { status: 400 });
  }
  if (typeof body !== "object" || body === null) {
    return NextResponse.json({ error: "Request body must be a JSON object" }, { status: 400 });
  }

  const { modelId, areaId, assignedEmployeeId, assetTag, serialNumber, specs } =
    body as Record<string, unknown>;
  const validation = validateUpdateInventoryScanInput({
    modelId,
    areaId,
    assignedEmployeeId,
    assetTag,
    serialNumber,
    specs,
  });
  if (!validation.ok) {
    return NextResponse.json({ error: validation.error }, { status: 400 });
  }

  const updated = await updateInventoryScan(params.id, validation.value);
  if (!updated.ok) {
    const status = updated.error === "InventoryScan not found" ? 404 : 400;
    return NextResponse.json({ error: updated.error }, { status });
  }
  return NextResponse.json(updated.value, { status: 200 });
}

export async function DELETE(
  request: Request,
  { params }: { params: { id: string } }
): Promise<NextResponse> {
  const session = await auth();
  if (!session) {
    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
  }

  if (!z.string().uuid().safeParse(params.id).success) {
    return NextResponse.json({ error: "id must be a valid UUID string" }, { status: 400 });
  }

  const result = await deleteInventoryScan(params.id);
  if (!result.ok) {
    return NextResponse.json({ error: result.error }, { status: 404 });
  }
  return new NextResponse(null, { status: 204 });
}