import { NextResponse } from "next/server";
import { query, queryOne } from "@/lib/db";
import { authErrorResponse, requireRole } from "@/lib/auth/session";
import { isSameOrigin } from "@/lib/origin";
import type { DishSuggestion } from "@/lib/types";

export async function GET() {
  try {
    await requireRole(["staff", "admin"]);
  } catch (err) {
    const res = authErrorResponse(err);
    if (res) return res;
    throw err;
  }
  const items = await query<DishSuggestion>(
    "select * from dish_suggestions order by created_at desc"
  );
  return NextResponse.json(items);
}

export async function POST(request: Request) {
  if (!isSameOrigin(request)) {
    return NextResponse.json({ error: "Nicht erlaubt." }, { status: 403 });
  }
  const body = (await request.json().catch(() => ({}))) as {
    name?: string;
    description?: string;
  };
  const name = body.name?.trim();
  if (!name) return NextResponse.json({ error: "name_required" }, { status: 400 });

  // Serverseitig statt clientseitig (wie zuvor über den anon-Postgrest-
  // Zugriff): es gibt keinen Browser→Postgres-Pfad mehr.
  const existing = await queryOne<{ id: string }>(
    "select id from dishes where name ilike $1 limit 1",
    [name]
  );
  if (existing) return NextResponse.json({ error: "duplicate" }, { status: 409 });

  await query("insert into dish_suggestions (name, description) values ($1, $2)", [
    name,
    body.description?.trim() || null,
  ]);
  return NextResponse.json({ ok: true }, { status: 201 });
}