/**
 * bituach-leumi.ts — Bituach Leumi (NII) report routes.
 * Spec: 2026-06-01-bituach-leumi (spec 175, wave-15)
 *
 * Mounted at /api/reports in the reports router.
 *
 * Routes:
 *   GET /bituach-leumi       ?year&depreciation_deduction?  reports:read   → BituachLeumiReport JSON
 *   GET /bituach-leumi/xlsx  ?year&depreciation_deduction?  reports:export → xlsx download
 */
import { Hono } from 'hono'
import { z } from 'zod'
import { createDb } from '@zync/db/queries'
import type { AppEnv } from '../../types'
import { authMiddleware } from '../../middleware/auth'
import { requirePermission } from '../../middleware/guards'
import { loadNIIRates } from '../../lib/nii-rates'
import { getBituachLeumiReport } from '../../services/bituach-leumi'
import { buildBituachLeumiXlsx } from '../../lib/bituach-leumi-xlsx'

// ── Zod schema ────────────────────────────────────────────────────────────────

const querySchema = z.object({
  year: z
    .string()
    .regex(/^\d{4}$/, 'year must be a 4-digit integer')
    .transform((s) => parseInt(s, 10)),
  depreciation_deduction: z
    .string()
    .optional()
    .transform((s) => (s ? parseFloat(s) : 0))
    .refine((n) => n >= 0, 'depreciation_deduction must be non-negative'),
})

// ── Router ────────────────────────────────────────────────────────────────────

export const bituachLeumiRoutes = new Hono<AppEnv>()
bituachLeumiRoutes.use('*', authMiddleware)

// ── GET /bituach-leumi/xlsx — Excel export (BEFORE /bituach-leumi to avoid sub-path capture) ──

bituachLeumiRoutes.get('/bituach-leumi/xlsx', requirePermission('reports:export'), async (c) => {
  const session = c.get('session')
  if (!session || session.type !== 'user' || !session.tid || !session.sub) {
    return c.json({ error: 'Unauthorized' }, 401)
  }

  const url = new URL(c.req.url)
  const raw = Object.fromEntries(url.searchParams.entries())
  const parsed = querySchema.safeParse(raw)
  if (!parsed.success) {
    return c.json({ error: 'Invalid query', issues: parsed.error.issues }, 400)
  }

  let rates
  try {
    rates = await loadNIIRates(c.env, parsed.data.year)
  } catch {
    return c.json({ error: `NII rates not configured for year ${parsed.data.year}` }, 422)
  }

  const db = createDb(c.env)
  const report = await getBituachLeumiReport(
    db,
    session.tid,
    session.sub,
    parsed.data.year,
    parsed.data.depreciation_deduction,
    rates,
  )

  const bytes = await buildBituachLeumiXlsx(report, db, session.tid, session.sub)
  const filename = `bituach-leumi-${parsed.data.year}.xlsx`

  return new Response(bytes, {
    status: 200,
    headers: {
      'Content-Type': 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
      'Content-Disposition': `attachment; filename="${filename}"`,
      'Content-Length': String(bytes.byteLength),
      'X-Content-Type-Options': 'nosniff',
    },
  })
})

// ── GET /bituach-leumi — Report JSON ──────────────────────────────────────────

bituachLeumiRoutes.get('/bituach-leumi', requirePermission('reports:read'), async (c) => {
  const session = c.get('session')
  if (!session || session.type !== 'user' || !session.tid || !session.sub) {
    return c.json({ error: 'Unauthorized' }, 401)
  }

  const url = new URL(c.req.url)
  const raw = Object.fromEntries(url.searchParams.entries())
  const parsed = querySchema.safeParse(raw)
  if (!parsed.success) {
    return c.json({ error: 'Invalid query', issues: parsed.error.issues }, 400)
  }

  let rates
  try {
    rates = await loadNIIRates(c.env, parsed.data.year)
  } catch {
    return c.json({ error: `NII rates not configured for year ${parsed.data.year}` }, 422)
  }

  const db = createDb(c.env)
  const report = await getBituachLeumiReport(
    db,
    session.tid,
    session.sub,
    parsed.data.year,
    parsed.data.depreciation_deduction,
    rates,
  )

  return c.json(report, 200)
})