// Cahier d'erreurs : consultation et gestion des statuts.
import { NextResponse } from "next/server";
import { z } from "zod";
import { apiError, parseBody } from "@/lib/api.ts";
import { assertSameOrigin, requireUser } from "@/lib/auth/session.ts";
import { all, get, run } from "@/lib/db/index.ts";

export async function GET(req: Request) {
  try {
    const user = await requireUser();
    const url = new URL(req.url);
    const course = url.searchParams.get("course")?.toUpperCase() ?? null;
    const status = url.searchParams.get("status");
    const params: unknown[] = [user.id];
    let where = "e.user_id = ?";
    if (course) { where += " AND e.course_code = ?"; params.push(course); }
    if (status && ["comprise", "a-revoir", "maitrisee"].includes(status)) { where += " AND e.status = ?"; params.push(status); }
    const errors = all(
      `SELECT e.id, e.course_code, e.concept_id, c.name as concept_name, e.question, e.given_answer,
              e.correction, e.explanation, e.source, e.status, e.created_at
       FROM error_notebook e LEFT JOIN concepts c ON c.id = e.concept_id
       WHERE ${where} ORDER BY e.id DESC LIMIT 200`,
      ...params
    );
    return NextResponse.json({ errors });
  } catch (e) {
    return apiError(e);
  }
}

const schema = z.object({
  id: z.number().int().positive(),
  status: z.enum(["comprise", "a-revoir", "maitrisee"]).optional(),
  remove: z.boolean().optional(),
});

export async function PATCH(req: Request) {
  try {
    await assertSameOrigin();
    const user = await requireUser();
    const body = await parseBody(req, schema);
    const row = get("SELECT id FROM error_notebook WHERE id = ? AND user_id = ?", body.id, user.id);
    if (!row) return NextResponse.json({ error: "Entrée introuvable." }, { status: 404 });
    if (body.remove) run("DELETE FROM error_notebook WHERE id = ?", body.id);
    else if (body.status) run("UPDATE error_notebook SET status = ?, updated_at = datetime('now') WHERE id = ?", body.status, body.id);
    return NextResponse.json({ ok: true });
  } catch (e) {
    return apiError(e);
  }
}