Speisekarte/app/api/allergens/import/route.ts

import { NextResponse } from "next/server";
import { importCodes, type CodeImportRow } from "@/lib/db/code-lists";
import { authErrorResponse, requireRole } from "@/lib/auth/session";
import { isSameOrigin } from "@/lib/origin";
import { parseCsvWithHeader } from "@/lib/csv";

export async function POST(request: Request) {
  if (!isSameOrigin(request)) {
    return NextResponse.json({ error: "Nicht erlaubt." }, { status: 403 });
  }
  try {
    await requireRole(["staff", "admin"]);
    const form = await request.formData();
    const file = form.get("file");
    if (!(file instanceof File)) {
      return NextResponse.json({ error: "invalid_input" }, { status: 400 });
    }

    const { header, rows: cells } = parseCsvWithHeader(await file.text());
    const codeIdx = header.indexOf("code");
    const nameIdx = header.indexOf("name");
    if (codeIdx === -1 || nameIdx === -1) {
      return NextResponse.json({ error: "missing_columns" }, { status: 400 });
    }
    const nameEnIdx = header.indexOf("name_en");
    const namePlIdx = header.indexOf("name_pl");

    const rows: CodeImportRow[] = [];
    const skipped: { row: number; reason: string }[] = [];
    cells.forEach((c, i) => {
      const rowNum = i + 2; // 1-indexiert + Kopfzeile
      const code = (c[codeIdx] ?? "").trim();
      const name = (c[nameIdx] ?? "").trim();
      if (!code || !name) {
        skipped.push({ row: rowNum, reason: "Kürzel oder Bezeichnung fehlt" });
        return;
      }
      rows.push({
        code,
        name,
        name_en: nameEnIdx >= 0 ? c[nameEnIdx]?.trim() || null : null,
        name_pl: namePlIdx >= 0 ? c[namePlIdx]?.trim() || null : null,
      });
    });

    const result = rows.length > 0 ? await importCodes("allergens", rows) : { created: 0, updated: 0 };
    return NextResponse.json({ ...result, skipped });
  } catch (err) {
    const res = authErrorResponse(err);
    if (res) return res;
    throw err;
  }
}