import { NextResponse } from "next/server";
import { deleteCode, updateCode } from "@/lib/db/code-lists";
import { authErrorResponse, requireRole } from "@/lib/auth/session";
import { isSameOrigin } from "@/lib/origin";

export async function PATCH(
  request: Request,
  { params }: { params: Promise<{ code: string }> }
) {
  if (!isSameOrigin(request)) {
    return NextResponse.json({ error: "Nicht erlaubt." }, { status: 403 });
  }
  try {
    await requireRole(["staff", "admin"]);
    const { code } = await params;
    const body = await request.json();
    const item = await updateCode("additives", code, body);
    if (!item) return NextResponse.json({ error: "not_found" }, { status: 404 });
    return NextResponse.json(item);
  } catch (err) {
    const res = authErrorResponse(err);
    if (res) return res;
    if (err instanceof Error && /duplicate key/i.test(err.message)) {
      return NextResponse.json({ error: "duplicate_code" }, { status: 409 });
    }
    throw err;
  }
}

export async function DELETE(
  request: Request,
  { params }: { params: Promise<{ code: string }> }
) {
  if (!isSameOrigin(request)) {
    return NextResponse.json({ error: "Nicht erlaubt." }, { status: 403 });
  }
  try {
    await requireRole(["staff", "admin"]);
    const { code } = await params;
    await deleteCode("additives", code);
    return NextResponse.json({ ok: true });
  } catch (err) {
    const res = authErrorResponse(err);
    if (res) return res;
    throw err;
  }
}