/**
 * Contractor settings routes — contractor-settings (wave-11 leaf-E).
 * Mounted at /api/settings/contractors.
 *
 * GET  / → ContractorSettings (requires payouts:read)
 * PATCH / → ContractorSettings (requires payouts:write)
 */
import { Hono } from 'hono'
import { z } from 'zod'
import type { AppEnv } from '../../types'
import { authMiddleware } from '../../middleware/auth'
import { requirePermission } from '../../middleware/guards'
import {
  getContractorSettings,
  updateContractorSettings,
} from '@zync/db/queries'

const updateContractorSettingsSchema = z
  .object({
    contractor_portal_enabled: z.boolean().optional(),
    contractor_portal_show_billing: z.boolean().optional(),
    contractor_require_time_approval: z.boolean().optional(),
    contractor_approval_deadline_days: z.number().int().min(0).optional(),
    contractor_payout_period: z.enum(['weekly', 'biweekly', 'monthly']).optional(),
    contractor_withholding_note: z.string().trim().max(500).nullable().optional(),
  })
  .strict()
  .refine(
    (b) => Object.values(b).some((v) => v !== undefined),
    { message: 'At least one field must be provided' },
  )

export const contractorSettingsRoute = new Hono<AppEnv>()

contractorSettingsRoute.use('*', authMiddleware)

// ── GET /api/settings/contractors ─────────────────────────────────────────────

contractorSettingsRoute.get('/', requirePermission('payouts:read'), async (c) => {
  const session = c.get('session')
  if (!session || session.type !== 'user' || !session.tid) {
    return c.json({ error: 'Unauthorized' }, 401)
  }

  const db = c.get('db')
  const dto = await getContractorSettings(db, session.tid)
  return c.json(dto, 200)
})

// ── PATCH /api/settings/contractors ───────────────────────────────────────────

contractorSettingsRoute.patch('/', requirePermission('payouts:write'), async (c) => {
  const session = c.get('session')
  if (!session || session.type !== 'user' || !session.tid) {
    return c.json({ error: 'Unauthorized' }, 401)
  }

  const body = await c.req.json().catch(() => null)
  const parsed = updateContractorSettingsSchema.safeParse(body)
  if (!parsed.success) {
    return c.json({ error: 'Validation failed', issues: parsed.error.issues }, 400)
  }

  const db = c.get('db')
  const updated = await updateContractorSettings(db, session.tid, session.sub, parsed.data)
  return c.json(updated, 200)
})