import { NextResponse } from "next/server";
import { queryOne } from "@/lib/db";
import { loadMenuEntries } from "@/lib/db/menu-entries";
import { authErrorResponse, requireRole } from "@/lib/auth/session";
import { isSameOrigin } from "@/lib/origin";

export async function GET(request: Request) {
  const { searchParams } = new URL(request.url);
  const from = searchParams.get("from");
  const to = searchParams.get("to");
  if (!from || !to) {
    return NextResponse.json({ error: "invalid_input" }, { status: 400 });
  }
  return NextResponse.json(await loadMenuEntries(from, to));
}

export async function POST(request: Request) {
  if (!isSameOrigin(request)) {
    return NextResponse.json({ error: "Nicht erlaubt." }, { status: 403 });
  }
  try {
    await requireRole(["staff", "admin"]);
    const body = (await request.json()) as {
      menu_date: string;
      section_key: string;
      dish_id: string;
    };
    const entry = await queryOne<{ id: string }>(
      "insert into menu_entries (menu_date, section_key, dish_id) values ($1, $2, $3) returning id",
      [body.menu_date, body.section_key, body.dish_id]
    );
    return NextResponse.json(entry, { status: 201 });
  } catch (err) {
    const res = authErrorResponse(err);
    if (res) return res;
    if (err instanceof Error && /duplicate key/i.test(err.message)) {
      return NextResponse.json({ error: "duplicate_entry" }, { status: 409 });
    }
    throw err;
  }
}