// Bibliothèque personnelle : éléments sauvegardés (réponses, résumés, notes).
import { NextResponse } from "next/server";
import { z } from "zod";
import { apiError, parseBody } from "@/lib/api.ts";
import { assertSameOrigin, requireUser } from "@/lib/auth/session.ts";
import { all, get, run } from "@/lib/db/index.ts";

export async function GET(req: Request) {
  try {
    const user = await requireUser();
    const url = new URL(req.url);
    const kind = url.searchParams.get("kind");
    const params: unknown[] = [user.id];
    let where = "user_id = ?";
    if (kind) { where += " AND kind = ?"; params.push(kind); }
    const items = all(`SELECT id, kind, course_code, title, content, meta, created_at FROM saved_items WHERE ${where} ORDER BY id DESC LIMIT 200`, ...params);
    return NextResponse.json({ items });
  } catch (e) {
    return apiError(e);
  }
}

const createSchema = z.object({
  kind: z.enum(["note", "answer", "summary", "quiz", "plan"]),
  courseCode: z.enum(["IMM1003", "IMM1033"]).nullable().optional(),
  title: z.string().min(1).max(200),
  content: z.string().max(50_000),
});

export async function POST(req: Request) {
  try {
    await assertSameOrigin();
    const user = await requireUser();
    const body = await parseBody(req, createSchema);
    const r = run(
      "INSERT INTO saved_items (user_id, kind, course_code, title, content) VALUES (?, ?, ?, ?, ?)",
      user.id, body.kind, body.courseCode ?? null, body.title, body.content
    );
    return NextResponse.json({ ok: true, id: Number(r.lastInsertRowid) });
  } catch (e) {
    return apiError(e);
  }
}

export async function DELETE(req: Request) {
  try {
    await assertSameOrigin();
    const user = await requireUser();
    const { id } = await parseBody(req, z.object({ id: z.number().int().positive() }));
    const row = get("SELECT id FROM saved_items WHERE id = ? AND user_id = ?", id, user.id);
    if (!row) return NextResponse.json({ error: "Élément introuvable." }, { status: 404 });
    run("DELETE FROM saved_items WHERE id = ?", id);
    return NextResponse.json({ ok: true });
  } catch (e) {
    return apiError(e);
  }
}