/**
 * Burndown route — task-estimates-burndown spec (112).
 *
 * GET /api/projects/:id/burndown?from=YYYY-MM-DD&to=YYYY-MM-DD
 *
 * Returns daily burndown data for a project:
 *   { totalEstimatedHours, days: [{ date, loggedCumulative, remaining }] }
 *
 * Permissions: tasks:read  (Business+ tier — caller enforces tier gate via ModuleGuard)
 *
 * Mounting: declare in apps/zync-api/src/routes/index.ts:
 *   import { burndownRoute } from './burndown'
 *   routes.route('/projects', burndownRoute)   // resolves to /api/projects/:id/burndown
 */
import { Hono } from 'hono'
import { z } from 'zod'
import type { AppEnv } from '../types'
import { requirePermission, requireTier } from '../middleware/guards'
import { authMiddleware } from '../middleware/auth'
import { createDb, getProjectBurndown, burndownQuerySchema } from '@zync/db/queries'
import { TenantTier } from '@zync/types'

export const burndownRoute = new Hono<AppEnv>()

burndownRoute.use('*', authMiddleware)
burndownRoute.use('*', requireTier(TenantTier.BUSINESS))

// GET /api/projects/:id/burndown
burndownRoute.get(
  '/:id/burndown',
  requirePermission('tasks:read'),
  async (c) => {
    const session = c.get('session')
    if (!session || session.type !== 'user' || !session.tid) {
      return c.json({ error: 'Unauthorized' }, 401)
    }

    const projectId = c.req.param('id')
    if (!z.string().uuid().safeParse(projectId).success) {
      return c.json({ error: 'Invalid project id' }, 400)
    }

    const url = new URL(c.req.url)
    const rawQuery = {
      from: url.searchParams.get('from') ?? '',
      to: url.searchParams.get('to') ?? '',
    }

    const parsed = burndownQuerySchema.safeParse(rawQuery)
    if (!parsed.success) {
      return c.json({ error: 'Invalid query parameters', issues: parsed.error.issues }, 422)
    }

    const { from, to } = parsed.data
    if (from > to) {
      return c.json({ error: "'from' must be <= 'to'" }, 422)
    }

    const db = createDb(c.env)
    const result = await getProjectBurndown(db, session.tid, projectId, from, to)

    return c.json(result, 200)
  },
)