Speisekarte/app/api/admin/languages/[code]/route.ts

import { NextResponse } from "next/server";
import {
  deleteLanguage,
  setLanguageActive,
  updateLanguageLabel,
} from "@/lib/db/languages";
import { ForbiddenError, requireRole, UnauthorizedError } from "@/lib/auth/session";
import { isSameOrigin } from "@/lib/origin";

async function requireAdmin(request: Request) {
  if (!isSameOrigin(request)) throw new ForbiddenError();
  return requireRole(["admin"]);
}

function errorResponse(err: unknown) {
  if (err instanceof UnauthorizedError || err instanceof ForbiddenError) {
    return NextResponse.json({ error: "Nicht berechtigt." }, { status: 403 });
  }
  return null;
}

export async function PATCH(
  request: Request,
  { params }: { params: Promise<{ code: string }> }
) {
  try {
    await requireAdmin(request);
  } catch (err) {
    const res = errorResponse(err);
    if (res) return res;
    throw err;
  }

  const { code } = await params;
  const body = await request.json().catch(() => null);

  try {
    if (typeof body?.active === "boolean") {
      await setLanguageActive(code, body.active);
    }
    if (typeof body?.label === "string" && body.label.trim()) {
      await updateLanguageLabel(code, body.label.trim());
    }
    return NextResponse.json({ ok: true });
  } catch (err) {
    if (err instanceof Error && err.message === "cannot_deactivate_last") {
      return NextResponse.json({ error: "cannot_deactivate_last" }, { status: 400 });
    }
    throw err;
  }
}

export async function DELETE(
  request: Request,
  { params }: { params: Promise<{ code: string }> }
) {
  try {
    await requireAdmin(request);
  } catch (err) {
    const res = errorResponse(err);
    if (res) return res;
    throw err;
  }

  const { code } = await params;
  try {
    await deleteLanguage(code);
    return NextResponse.json({ ok: true });
  } catch (err) {
    if (err instanceof Error && err.message === "cannot_delete_base") {
      return NextResponse.json({ error: "cannot_delete_base" }, { status: 400 });
    }
    throw err;
  }
}