/**
 * Customer contacts API routes — customers module (Task 5).
 *
 * GET    /api/customers/:id/contacts          list contacts
 * POST   /api/customers/:id/contacts          add contact
 * PATCH  /api/customers/:id/contacts/:cid     update contact
 * DELETE /api/customers/:id/contacts/:cid     remove contact
 *
 * Setting isPrimary=true clears the prior primary atomically (delegated to helper).
 */
import { Hono } from 'hono'
import { addContact, listContacts, removeContact, updateContact } from '@zync/db/queries'
import type { AppEnv } from '../../types'
import { requirePermission } from '../../middleware/guards'
import { contactSchema } from '../../schemas/customers'

export const contactsRoute = new Hono<AppEnv>()

// GET /api/customers/:id/contacts
contactsRoute.get('/:id/contacts', requirePermission('customers:read'), async (c) => {
  const session = c.get('session')
  if (!session || session.type !== 'user' || !session.tid) {
    return c.json({ error: 'Unauthorized' }, 401)
  }

  const db = c.get('db')
  const contacts = await listContacts(db, session.tid, c.req.param('id'))
  return c.json(contacts, 200)
})

// POST /api/customers/:id/contacts
contactsRoute.post('/:id/contacts', requirePermission('customers:write'), async (c) => {
  const session = c.get('session')
  if (!session || session.type !== 'user' || !session.tid) {
    return c.json({ error: 'Unauthorized' }, 401)
  }

  const parsed = contactSchema.safeParse(await c.req.json())
  if (!parsed.success) {
    return c.json({ error: 'Invalid request', issues: parsed.error.issues }, 400)
  }

  const db = c.get('db')
  const contact = await addContact(db, session.tid, c.req.param('id'), parsed.data, session.sub)
  return c.json(contact, 201)
})

// PATCH /api/customers/:id/contacts/:cid
contactsRoute.patch('/:id/contacts/:cid', requirePermission('customers:write'), async (c) => {
  const session = c.get('session')
  if (!session || session.type !== 'user' || !session.tid) {
    return c.json({ error: 'Unauthorized' }, 401)
  }

  const parsed = contactSchema.partial().safeParse(await c.req.json())
  if (!parsed.success) {
    return c.json({ error: 'Invalid request', issues: parsed.error.issues }, 400)
  }

  const db = c.get('db')
  try {
    const contact = await updateContact(
      db,
      session.tid,
      c.req.param('id'),
      c.req.param('cid'),
      parsed.data,
      session.sub,
    )
    return c.json(contact, 200)
  } catch (err) {
    if (err instanceof Error && err.message === 'Contact not found') {
      return c.json({ error: 'Not found' }, 404)
    }
    throw err
  }
})

// DELETE /api/customers/:id/contacts/:cid
contactsRoute.delete('/:id/contacts/:cid', requirePermission('customers:write'), async (c) => {
  const session = c.get('session')
  if (!session || session.type !== 'user' || !session.tid) {
    return c.json({ error: 'Unauthorized' }, 401)
  }

  const db = c.get('db')
  await removeContact(db, session.tid, c.req.param('id'), c.req.param('cid'), session.sub)
  return new Response(null, { status: 204 })
})