// app/api/enrollments/sync/route.ts
import { NextResponse } from 'next/server';
import { getServerSession } from 'next-auth';
import { authOptions } from '@/lib/auth-options';
import { prisma } from '@/lib/prisma';
import { normalizeEmail } from '@/lib/normalize-email';

/**
 * Enrols the signed-in user in the courses listed for them on the allow-list.
 * The course codes are read from the database; anything the browser sends is
 * ignored, so a user cannot enrol themselves in a course they were not given.
 */
export async function POST() {
  try {
    const session = await getServerSession(authOptions);
    const email = normalizeEmail(session?.user?.email);
    if (!email) {
      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
    }

    const user = await prisma.user.findFirst({
      where: { email: { equals: email, mode: 'insensitive' } },
      select: { id: true },
    });
    if (!user) {
      return NextResponse.json({ error: 'User not found' }, { status: 404 });
    }

    const allowedStudent = await prisma.allowedStudent.findFirst({
      where: { email: { equals: email, mode: 'insensitive' } },
      select: { levels: true, active: true },
    });

    const levels = allowedStudent?.active
      ? allowedStudent.levels
          .split(',')
          .map((level) => level.trim())
          .filter((level) => level.length > 0)
      : [];

    if (levels.length === 0) {
      return NextResponse.json({ message: 'Enrollments synced', created: [] });
    }

    const courses = await prisma.course.findMany({
      where: { code: { in: levels } },
      select: { id: true, code: true },
    });

    const missing = levels.filter((level) => !courses.some((c) => c.code === level));
    if (missing.length > 0) {
      console.warn(`[SYNC-ENROLLMENTS] Course codes not found: ${missing.join(', ')}`);
    }

    const created = [];
    for (const course of courses) {
      const existing = await prisma.enrollment.findUnique({
        where: { userId_courseId: { userId: user.id, courseId: course.id } },
        select: { id: true },
      });
      if (existing) continue;

      const enrollment = await prisma.enrollment.create({
        data: { userId: user.id, courseId: course.id },
      });
      created.push({
        courseCode: course.code,
        courseId: course.id,
        enrollmentId: enrollment.id,
      });
    }

    return NextResponse.json({ message: 'Enrollments synced', created });
  } catch (err) {
    console.error('[SYNC-ENROLLMENTS] error:', err);
    return NextResponse.json({ error: 'Failed to sync enrollments' }, { status: 500 });
  }
}