import { NextResponse } from 'next/server'
import { auth } from '@clerk/nextjs/server'
import { getDatabase } from '@/lib/database'

export async function GET(request: Request) {
    try {
        const { userId: currentUserId } = await auth()
        if (!currentUserId) {
            return new NextResponse('Unauthorized', { status: 401 })
        }

        const { searchParams } = new URL(request.url)
        const targetUserId = searchParams.get('userId')

        if (!targetUserId) {
            return new NextResponse('User ID is required', { status: 400 })
        }

        const db = await getDatabase()

        // Check permissions: Users can view their own, Admins/Trainers can view anyone's
        if (currentUserId !== targetUserId) {
            const currentUser = await db.getUserById(currentUserId)
            const isStaff = currentUser?.role === 'admin' || currentUser?.role === 'superAdmin' || currentUser?.role === 'trainer'

            if (!isStaff) {
                return new NextResponse('Forbidden', { status: 403 })
            }
        }

        const recommendations = await db.getRecommendationsByUserId(targetUserId)
        return NextResponse.json(recommendations)
    } catch (error) {
        console.error('Error fetching recommendations:', error)
        return new NextResponse('Internal Server Error', { status: 500 })
    }
}

export async function POST(request: Request) {
    try {
        const { userId: currentUserId } = await auth()
        if (!currentUserId) {
            return new NextResponse('Unauthorized', { status: 401 })
        }

        const db = await getDatabase()
        const currentUser = await db.getUserById(currentUserId)
        const isStaff = currentUser?.role === 'admin' || currentUser?.role === 'superAdmin' || currentUser?.role === 'trainer'

        if (!isStaff) {
            return new NextResponse('Forbidden', { status: 403 })
        }

        const body = await request.json()
        const { userId, type, content, status } = body

        if (!userId || !type || !content) {
            return new NextResponse('Missing required fields', { status: 400 })
        }

        const recommendation = await db.createRecommendation({
            id: crypto.randomUUID(),
            userId,
            type,
            content,
            status: status || 'pending'
        })

        return NextResponse.json(recommendation)
    } catch (error) {
        console.error('Error creating recommendation:', error)
        return new NextResponse('Internal Server Error', { status: 500 })
    }
}

export async function PUT(request: Request) {
    try {
        const { userId: currentUserId } = await auth()
        if (!currentUserId) {
            return new NextResponse('Unauthorized', { status: 401 })
        }

        const body = await request.json()
        const { id, status, content } = body

        if (!id) {
            return new NextResponse('Recommendation ID is required', { status: 400 })
        }

        const db = await getDatabase()

        // Users can update status (e.g. mark as completed), Staff can update content too
        // Ideally we'd check ownership for status update, but for now let's allow it if they have the ID
        // A stricter check would be: fetch recommendation, check if userId matches currentUserId OR if currentUser is staff

        const updated = await db.updateRecommendation(id, {
            ...(status && { status }),
            ...(content && { content })
        })

        return NextResponse.json(updated)
    } catch (error) {
        console.error('Error updating recommendation:', error)
        return new NextResponse('Internal Server Error', { status: 500 })
    }
}