import { NextRequest, NextResponse } from 'next/server'
import { z } from 'zod'
import { getServerSession } from 'next-auth'
import { authOptions } from '@/lib/auth'
import { prisma } from '@/lib/prisma'
import { ModerationStatus } from '@prisma/client'

const schema = z.object({
  action: z.enum(['APPROVED', 'REJECTED', 'REVISION', 'FLAGGED']),
  note: z.string().max(500).optional(),
})

export async function PATCH(req: NextRequest, { params }: { params: { id: string } }) {
  const session = await getServerSession(authOptions)
  if (!session?.user) return NextResponse.json({ error: 'Não autenticado' }, { status: 401 })
  if (session.user.role !== 'MODERATOR' && session.user.role !== 'ADMIN') {
    return NextResponse.json({ error: 'Sem permissão' }, { status: 403 })
  }

  const body = await req.json().catch(() => null)
  if (!body) return NextResponse.json({ error: 'Invalid JSON' }, { status: 400 })

  const parsed = schema.safeParse(body)
  if (!parsed.success) return NextResponse.json({ error: parsed.error.flatten() }, { status: 422 })

  const review = await prisma.review.update({
    where: { id: params.id },
    data: {
      status: parsed.data.action as ModerationStatus,
      moderationNote: parsed.data.note,
      moderatedAt: new Date(),
      moderatedById: session.user.id,
    },
    select: { id: true, status: true, spotId: true },
  })

  await prisma.moderationLog.create({
    data: {
      entityType: 'review',
      entityId: params.id,
      action: parsed.data.action as ModerationStatus,
      note: parsed.data.note,
      moderatorId: session.user.id,
      reviewId: params.id,
    },
  })

  return NextResponse.json({ review })
}