import { NextRequest, NextResponse } from 'next/server'
import { z } from 'zod'
import { getServerSession } from 'next-auth'
import { authOptions } from '@/lib/auth'
import { prisma } from '@/lib/prisma'
import { ModerationStatus } from '@prisma/client'

const schema = z.object({
  action: z.enum(['APPROVED', 'REJECTED', 'REVISION', 'FLAGGED']),
  note: z.string().max(500).optional(),
})

export async function PATCH(req: NextRequest, { params }: { params: { id: string } }) {
  const session = await getServerSession(authOptions)
  if (!session?.user) return NextResponse.json({ error: 'Não autenticado' }, { status: 401 })
  if (session.user.role !== 'MODERATOR' && session.user.role !== 'ADMIN') {
    return NextResponse.json({ error: 'Sem permissão' }, { status: 403 })
  }

  const body = await req.json().catch(() => null)
  if (!body) return NextResponse.json({ error: 'Invalid JSON' }, { status: 400 })

  const parsed = schema.safeParse(body)
  if (!parsed.success) return NextResponse.json({ error: parsed.error.flatten() }, { status: 422 })

  const { action, note } = parsed.data

  const spot = await prisma.spot.update({
    where: { id: params.id },
    data: {
      status: action as ModerationStatus,
      moderationNote: note,
      moderatedAt: new Date(),
      moderatedById: session.user.id,
    },
    select: { id: true, status: true },
  })

  await prisma.moderationLog.create({
    data: {
      entityType: 'spot',
      entityId: params.id,
      action: action as ModerationStatus,
      note,
      moderatorId: session.user.id,
      spotId: params.id,
    },
  })

  return NextResponse.json({ spot })
}