import { NextRequest, NextResponse } from "next/server";
import { auth } from "@/auth";
import { db } from "@/lib/db";

function requireRole(role: string) {
  return ["ADMIN", "PRODUCER", "SUPERVISOR"].includes(role);
}

// PATCH /api/shoot-log/takes/[takeId]/attachments/[attachmentId]
export async function PATCH(
  req: NextRequest,
  { params }: { params: Promise<{ takeId: string; attachmentId: string }> }
) {
  const session = await auth();
  if (!session?.user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
  if (!requireRole(session.user.role))
    return NextResponse.json({ error: "Forbidden" }, { status: 403 });

  const { attachmentId } = await params;
  const { caption, category } = await req.json();

  const attachment = await db.takeAttachment.update({
    where: { id: attachmentId },
    data: {
      ...(caption !== undefined ? { caption } : {}),
      ...(category !== undefined ? { category } : {}),
    },
  });

  return NextResponse.json({ attachment });
}

// DELETE /api/shoot-log/takes/[takeId]/attachments/[attachmentId]
export async function DELETE(
  _req: NextRequest,
  { params }: { params: Promise<{ takeId: string; attachmentId: string }> }
) {
  const session = await auth();
  if (!session?.user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
  if (!requireRole(session.user.role))
    return NextResponse.json({ error: "Forbidden" }, { status: 403 });

  const { attachmentId } = await params;
  await db.takeAttachment.delete({ where: { id: attachmentId } });
  return NextResponse.json({ ok: true });
}