Speisekarte/app/api/admin/languages/[code]/import/route.ts

import { NextResponse } from "next/server";
import { getLanguage, importTranslations } from "@/lib/db/languages";
import { currentTemplateHash, validateImport } from "@/lib/i18n/template";
import { ForbiddenError, requireRole, UnauthorizedError } from "@/lib/auth/session";
import { isSameOrigin } from "@/lib/origin";

export async function POST(
  request: Request,
  { params }: { params: Promise<{ code: string }> }
) {
  try {
    if (!isSameOrigin(request)) throw new ForbiddenError();
    await requireRole(["admin"]);
  } catch (err) {
    if (err instanceof UnauthorizedError || err instanceof ForbiddenError) {
      return NextResponse.json({ error: "Nicht berechtigt." }, { status: 403 });
    }
    throw err;
  }

  const { code } = await params;
  const language = await getLanguage(code);
  if (!language) {
    return NextResponse.json({ error: "not_found" }, { status: 404 });
  }
  if (language.is_base) {
    return NextResponse.json({ error: "cannot_import_base" }, { status: 400 });
  }

  const form = await request.formData();
  const file = form.get("file");
  if (!(file instanceof File)) {
    return NextResponse.json({ error: "invalid_input" }, { status: 400 });
  }

  let parsed: unknown;
  try {
    parsed = JSON.parse(await file.text());
  } catch {
    return NextResponse.json({ error: "invalid_json" }, { status: 400 });
  }
  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
    return NextResponse.json({ error: "invalid_json" }, { status: 400 });
  }

  const { entries, skipped } = validateImport(parsed as Record<string, unknown>);
  if (entries.length > 0) {
    await importTranslations(code, entries, currentTemplateHash());
  }

  return NextResponse.json({ imported: entries.length, skipped });
}