import { NextRequest, NextResponse } from "next/server";
import { prisma } from "@/lib/prisma";
import { requireAdmin, requireAuth } from "@/lib/session";
import { CertificateStatus } from "@prisma/client";

export async function GET(req: NextRequest) {
  const session = await requireAuth();
  if (!session) return NextResponse.json({ error: "Non autorisé" }, { status: 401 });

  try {
    if (session.user.role === "ADMIN") {
      const certificates = await prisma.certificate.findMany({
        orderBy: { createdAt: "desc" },
        include: { user: { select: { id: true, name: true, email: true } } },
      });
      return NextResponse.json(certificates);
    }

    const certs = await prisma.certificate.findMany({
      where: { userId: session.user.id },
      orderBy: { createdAt: "desc" },
    });
    return NextResponse.json(certs);
  } catch {
    return NextResponse.json({ error: "Erreur" }, { status: 500 });
  }
}

export async function POST(req: NextRequest) {
  const session = await requireAuth();
  if (!session) return NextResponse.json({ error: "Non autorisé" }, { status: 401 });

  const { fileUrl } = await req.json();
  if (!fileUrl) return NextResponse.json({ error: "Fichier requis" }, { status: 400 });

  try {
    const cert = await prisma.certificate.create({
      data: {
        userId: session.user.id,
        fileUrl,
      },
    });
    return NextResponse.json(cert, { status: 201 });
  } catch (error) {
    console.error(error);
    return NextResponse.json({ error: "Erreur" }, { status: 500 });
  }
}

export async function PATCH(req: NextRequest) {
  const admin = await requireAdmin();
  if (!admin) return NextResponse.json({ error: "Admin requis" }, { status: 403 });

  const { id, status } = await req.json();
  if (!id || !status) return NextResponse.json({ error: "id et status requis" }, { status: 400 });

  try {
    const cert = await prisma.certificate.update({
      where: { id },
      data: {
        status: status as CertificateStatus,
        reviewedAt: new Date(),
      },
    });
    return NextResponse.json(cert);
  } catch {
    return NextResponse.json({ error: "Erreur" }, { status: 500 });
  }
}