vfxreview/app/api/client/[token]/approve/route.ts

import { NextRequest, NextResponse } from "next/server";
import { db } from "@/lib/db";
import { ApprovalStatus } from "@prisma/client";
import { recalcShotStatus } from "@/lib/shot-status";
import { validateReviewToken } from "@/lib/review-auth";

async function getOrCreateClientUser(email: string, label?: string | null) {
  const existing = await db.user.findUnique({ where: { email } });
  if (existing) return existing;
  return db.user.create({
    data: {
      email,
      name: label ?? email.split("@")[0],
      role: "CLIENT",
      isActive: true,
    },
  });
}

export async function POST(
  req: NextRequest,
  { params }: { params: Promise<{ token: string }> }
) {
  const { token } = await params;
  const result = await validateReviewToken(token, req);
  if (result.type === "requiresPassword") {
    return NextResponse.json({ requiresPassword: true }, { status: 401 });
  }
  if (result.type === "invalid") {
    return NextResponse.json({ error: "Invalid or expired review link" }, { status: 403 });
  }
  const session = result.session;

  const body = await req.json();
  const { versionId, shotId, action, status, notes } = body;

  // ── Shot-level approval action ──────────────────────────────────────────────
  if (shotId && action) {
    const shot = await db.shot.findUnique({
      where: { id: shotId },
      select: { projectId: true, sharedWithClient: true, shotVersion: true },
    });
    if (!shot || shot.projectId !== session.projectId) {
      return NextResponse.json({ error: "Shot not found" }, { status: 404 });
    }
    if (!shot.sharedWithClient) {
      return NextResponse.json({ error: "Shot is not available for client review" }, { status: 403 });
    }

    if (action === "APPROVE") {
      await db.shot.update({
        where: { id: shotId },
        data: { shotApprovalStatus: "CLIENT_APPROVED", status: "COMPLETE" },
      });
    } else if (action === "NEEDS_CHANGES") {
      // Increment shotVersion: v001 → v002, v009 → v010, etc.
      const currentVer = shot.shotVersion ?? "v001";
      const verMatch = currentVer.match(/^v(\d+)$/);
      const nextNum = verMatch ? parseInt(verMatch[1], 10) + 1 : 2;
      const nextVersion = "v" + String(nextNum).padStart(3, "0");

      await db.$transaction(async (tx) => {
        await tx.shot.update({
          where: { id: shotId },
          data: { shotApprovalStatus: "PENDING", sharedWithClient: false, shotVersion: nextVersion },
        });
        // Mark all non-DONE tasks as CHANGES
        await tx.task.updateMany({
          where: { shotId, status: { not: "DONE" } },
          data: { status: "CHANGES" },
        });
        await recalcShotStatus(shotId, tx);
      });
    } else {
      return NextResponse.json({ error: "Invalid action" }, { status: 400 });
    }

    return NextResponse.json({ success: true });
  }

  // ── Version-level approval (legacy task-based flow) ─────────────────────────
  const validStatuses: ApprovalStatus[] = ["APPROVED", "REJECTED", "NEEDS_CHANGES"];
  if (!versionId || !validStatuses.includes(status)) {
    return NextResponse.json({ error: "versionId and valid status required" }, { status: 400 });
  }

  // Ensure the version belongs to this project via its task
  const version = await db.version.findUnique({
    where: { id: versionId },
    include: {
      task: {
        include: { shot: true, project: true },
      },
    },
  });

  const projectId = version?.task?.projectId;
  if (!version || projectId !== session.projectId) {
    return NextResponse.json({ error: "Version not found" }, { status: 404 });
  }

  const email = session.email ?? `client+${token.slice(0, 8)}@review.external`;
  const user = await getOrCreateClientUser(email, session.label);

  // Record approval
  await db.approval.create({
    data: { versionId, userId: user.id, status, notes },
  });

  // Update version approval status
  await db.version.update({
    where: { id: versionId },
    data: { approvalStatus: status },
  });

  // Update task status based on approval decision
  if (version.task) {
    if (status === "APPROVED") {
      await db.task.update({ where: { id: version.task.id }, data: { status: "DONE" } });

      // If this version belongs to a shot that is shared with the client,
      // also approve the shot at the shot level so it moves to COMPLETE.
      if (version.task.shot) {
        const shot = await db.shot.findUnique({
          where: { id: version.task.shot.id },
          select: { sharedWithClient: true, shotApprovalStatus: true },
        });
        if (shot?.sharedWithClient && shot.shotApprovalStatus !== "CLIENT_APPROVED") {
          await db.shot.update({
            where: { id: version.task.shot.id },
            data: { shotApprovalStatus: "CLIENT_APPROVED", status: "COMPLETE" },
          });
        }
      }
    } else {
      await db.task.update({ where: { id: version.task.id }, data: { status: "CHANGES" } });
    }

    // Recalculate derived shot status
    if (version.task.shot) {
      await recalcShotStatus(version.task.shot.id).catch(() => {});
    }
  }

  // Slack notification
  if (version.task?.project?.slackWebhook) {
    const { slackNotifyApproval } = await import("@/lib/slack");
    const appUrl = process.env.NEXT_PUBLIC_APP_URL ?? "";
    const contextCode = version.task.shot?.shotCode ?? version.task.title;
    await slackNotifyApproval(version.task.project.slackWebhook, {
      shotCode: contextCode,
      versionLabel: `v${String(version.versionNumber).padStart(3, "0")}`,
      reviewerName: user.name ?? "Client",
      status,
      projectName: version.task.project.name,
      reviewUrl: `${appUrl}/client/${token}/review/${versionId}`,
    });
  }

  return NextResponse.json({ success: true });
}