/**
 * settings-tax.ts — Tax settings PATCH route.
 * Spec: 2026-06-01-israeli-tax-reports (wave-14)
 *
 * GET  /api/settings/tax   settings:read
 * PATCH /api/settings/tax   settings:write
 *   body: { advance_tax_rate_pct?, vat_period?, advance_payments_ytd_ils? }
 *   → { vatPeriod, advanceTaxRatePct, advancePaymentsYtdIls }
 */
import { Hono } from 'hono'
import { z } from 'zod'
import { createDb, updateTaxSettings, getTaxSettings } from '@zync/db/queries'
import type { AppEnv } from '../types'
import { authMiddleware } from '../middleware/auth'
import { requirePermission } from '../middleware/guards'

// ── Zod schema ────────────────────────────────────────────────────────────────

const taxSettingsPatchSchema = z
  .object({
    advance_tax_rate_pct: z
      .number()
      .min(0, 'advance_tax_rate_pct must be >= 0')
      .max(100, 'advance_tax_rate_pct must be <= 100')
      .optional(),
    vat_period: z.enum(['monthly', 'bimonthly']).optional(),
    advance_payments_ytd_ils: z.coerce
      .number()
      .min(0, 'advance_payments_ytd_ils must be >= 0')
      .optional(),
  })
  .strict() // reject unknown keys

function toTaxSettingsResponse(settings: Awaited<ReturnType<typeof getTaxSettings>>) {
  return {
    vatPeriod: settings.vatPeriod,
    advanceTaxRatePct: settings.advanceTaxRatePct,
    advancePaymentsYtdIls: settings.advancePaymentsYtdIls,
  }
}

// ── Route ─────────────────────────────────────────────────────────────────────

export const taxSettingsRoute = new Hono<AppEnv>()

taxSettingsRoute.use('*', authMiddleware)

// ── GET /settings/tax — read current tax settings ─────────────────────────────

taxSettingsRoute.get('/', requirePermission('settings:read'), async (c) => {
  const session = c.get('session')
  if (!session || session.type !== 'user' || !session.tid) {
    return c.json({ error: 'Unauthorized' }, 401)
  }
  const db = createDb(c.env)
  const settings = await getTaxSettings(db, session.tid)
  return c.json(toTaxSettingsResponse(settings), 200)
})

// ── PATCH /settings/tax — update tax settings ─────────────────────────────────

taxSettingsRoute.patch('/', requirePermission('settings:write'), async (c) => {
  const session = c.get('session')
  if (!session || session.type !== 'user' || !session.tid) {
    return c.json({ error: 'Unauthorized' }, 401)
  }

  const body = await c.req.json().catch(() => null)
  const parsed = taxSettingsPatchSchema.safeParse(body)
  if (!parsed.success) {
    return c.json({ error: 'Invalid request', issues: parsed.error.issues }, 400)
  }

  const db = createDb(c.env)
  const updated = await updateTaxSettings(db, session.tid, {
    vatPeriod: parsed.data.vat_period,
    advanceTaxRatePct: parsed.data.advance_tax_rate_pct,
    advancePaymentsYtdIls: parsed.data.advance_payments_ytd_ils,
  })

  return c.json(toTaxSettingsResponse(updated), 200)
})