import { NextResponse } from "next/server";

import {
  employeeScopeFromAccess,
  requirePermission,
} from "@/lib/authorization";
import { getEmployeByCos } from "@/services/employes.service";
import {
  getProcedureById,
  saveProcedureFollowup,
} from "@/services/procedures.service";
import { procedureFollowupSchema } from "@/validators/procedures";

type RouteContext = { params: Promise<{ id: string }> };

export async function PUT(request: Request, { params }: RouteContext) {
  const auth = await requirePermission(request, "autres", "write");
  if (!auth.ok) return auth.response;

  const id = Number((await params).id);
  if (!Number.isInteger(id) || id <= 0) {
    return NextResponse.json({ message: "Identifiant invalide" }, { status: 400 });
  }

  const existing = await getProcedureById(id);
  if (!existing) {
    return NextResponse.json({ message: "Demande introuvable" }, { status: 404 });
  }

  const employee = await getEmployeByCos(
    existing.employee_cos,
    employeeScopeFromAccess(auth.access),
  );
  if (!employee) {
    return NextResponse.json({ message: "Demande introuvable" }, { status: 404 });
  }

  const parsed = procedureFollowupSchema.safeParse(
    await request.json().catch(() => null),
  );
  if (!parsed.success) {
    return NextResponse.json(
      { message: "Formulaire invalide", issues: parsed.error.issues },
      { status: 400 },
    );
  }

  try {
    const item = await saveProcedureFollowup(
      id,
      parsed.data,
      auth.principal.id,
    );
    return NextResponse.json({ item });
  } catch (error) {
    if (error instanceof Error && error.message === "FOLLOWUP_NOT_ALLOWED") {
      return NextResponse.json(
        { message: "Cette demande ne permet pas de suite de procédure." },
        { status: 409 },
      );
    }
    throw error;
  }
}