import { NextResponse } from 'next/server'
import { getServerSession } from 'next-auth'
import { authOptions } from '@/lib/auth'
import { prisma } from '@/lib/prisma'

export const dynamic = 'force-dynamic'

async function requireAdmin() {
  const session = await getServerSession(authOptions)
  if (!session?.user) return null
  if (session.user.role !== 'ADMIN' && session.user.role !== 'MODERATOR') return null
  return session
}

export async function GET() {
  const session = await requireAdmin()
  if (!session) return NextResponse.json({ error: 'Sem permissão' }, { status: 403 })

  const users = await prisma.user.findMany({
    orderBy: { createdAt: 'desc' },
    select: {
      id: true, name: true, email: true, role: true, createdAt: true, image: true,
      _count: { select: { spots: true, reviews: true } },
    },
  })

  return NextResponse.json({ users })
}

export async function PATCH(req: Request) {
  const session = await requireAdmin()
  if (!session) return NextResponse.json({ error: 'Sem permissão' }, { status: 403 })
  if (session.user.role !== 'ADMIN') {
    return NextResponse.json({ error: 'Apenas ADMIN pode alterar roles' }, { status: 403 })
  }

  const { userId, role } = await req.json() as { userId: string; role: string }

  if (!userId || !['USER', 'MODERATOR', 'ADMIN'].includes(role)) {
    return NextResponse.json({ error: 'Dados inválidos' }, { status: 400 })
  }

  if (userId === session.user.id) {
    return NextResponse.json({ error: 'Não podes alterar o teu próprio role' }, { status: 400 })
  }

  const updated = await prisma.user.update({
    where: { id: userId },
    data: { role: role as 'USER' | 'MODERATOR' | 'ADMIN' },
    select: { id: true, name: true, email: true, role: true },
  })

  return NextResponse.json({ user: updated })
}