/**
 * GET /api/search — app-shell (Task 8).
 *
 * Full-text search across all available entities, tenant-isolated.
 * Each entity group is independently guarded against missing tables (wave degradation).
 *
 * Auth: zync_session cookie (behind authMiddleware).
 * Query param: q (string, 1–200 chars) — validated by zod.
 * Response: { tasks, projects, invoices, customers, tickets, articles }
 *
 * Security: every source query is tenant-isolated via session.tid.
 * Rate limiting: the global auth middleware already applies per-IP limits.
 */
import { Hono } from 'hono'
import { z } from 'zod'
import type { AppEnv } from '../types'
import { authMiddleware } from '../middleware/auth'
import { createDb } from '@zync/db/queries'
import { runSearch } from '../search/sources'

const searchQuerySchema = z.object({
  q: z.string().min(1).max(200),
})

export const searchRoute = new Hono<AppEnv>()

searchRoute.use('*', authMiddleware)

searchRoute.get('/', async (c) => {
  const session = c.get('session')
  if (!session || session.type !== 'user' || !session.tid) {
    return c.json({ error: 'Unauthorized' }, 401)
  }

  const parsed = searchQuerySchema.safeParse({ q: c.req.query('q') })
  if (!parsed.success) {
    // Blank or invalid q — return empty grouped response (not an error)
    return c.json({
      tasks: [],
      projects: [],
      invoices: [],
      customers: [],
      tickets: [],
      articles: [],
    })
  }

  const { q } = parsed.data
  const db = createDb(c.env)

  const results = await runSearch(db, session.tid, q)

  return c.json(results)
})