/**
 * Calendar task routes — calendar-task-creation (wave-9 leaf 2).
 * Mounted inside calendarEventsRoute (calendar router).
 *
 * POST /events/:eventId/tasks — create task from calendar event
 * GET  /events/:eventId/tasks — list tasks linked to event
 */
import { Hono } from 'hono'
import { z } from 'zod'
import type { AppEnv } from '../../types'
import { requirePermission } from '../../middleware/guards'
import {
  createTaskFromCalendarEvent,
  getCalendarEventTasks,
  getCalendarEvent,
  assertActiveTenantAssignee,
  invalidTenantReferenceBody,
} from '@zync/db/queries'

export const calendarTasksRoute = new Hono<AppEnv>()

const createTaskFromEventSchema = z.object({
  title: z.string().min(1).max(500),
  priority: z.enum(['low', 'medium', 'high', 'urgent']).optional().default('medium'),
  assigneeId: z.string().uuid().optional().nullable(),
  dueDate: z.string().optional().nullable(),
})

// POST /events/:eventId/tasks
calendarTasksRoute.post(
  '/events/:eventId/tasks',
  requirePermission('calendar:read'),
  async (c) => {
    const session = c.get('session')
    if (!session || session.type !== 'user' || !session.tid) {
      return c.json({ error: 'Unauthorized' }, 401)
    }

    // Require both calendar:read (checked above) and tasks:write
    if (!session.permissions?.includes('tasks:write')) {
      return c.json({ error: 'tasks:write permission required' }, 403)
    }

    const parsed = createTaskFromEventSchema.safeParse(await c.req.json())
    if (!parsed.success) {
      return c.json({ error: 'Invalid request', issues: parsed.error.issues }, 400)
    }

    const db = c.get('db')
    const eventId = c.req.param('eventId')

    // Verify the calendar event belongs to this tenant
    const calendarEvent = await getCalendarEvent(db, session.tid, eventId)
    if (!calendarEvent) {
      return c.json({ error: 'Not found' }, 404)
    }

    if (!(await assertActiveTenantAssignee(db, session.tid, parsed.data.assigneeId))) {
      return c.json(invalidTenantReferenceBody('assignee_id'), 400)
    }

    try {
      const task = await createTaskFromCalendarEvent(
        db,
        session.tid,
        session.sub,
        eventId,
        parsed.data,
      )
      return c.json(task, 201)
    } catch (err) {
      if (err instanceof Error && err.message === 'No task statuses configured for this tenant') {
        return c.json({ error: err.message }, 409)
      }
      throw err
    }
  },
)

// GET /events/:eventId/tasks
calendarTasksRoute.get(
  '/events/:eventId/tasks',
  requirePermission('calendar:read'),
  async (c) => {
    const session = c.get('session')
    if (!session || session.type !== 'user' || !session.tid) {
      return c.json({ error: 'Unauthorized' }, 401)
    }

    const db = c.get('db')
    const tasks = await getCalendarEventTasks(db, session.tid, c.req.param('eventId'))
    return c.json({ tasks }, 200)
  },
)