/**
 * Project defaults settings routes — settings-projects (P062).
 * Mounted at /api/settings/projects.
 *
 * GET  / → { project_default_billing_type, project_default_hourly_rate,
 *             project_default_currency, project_default_time_tracking,
 *             project_default_time_rounding_minutes, project_default_budget_alert_pct,
 *             project_budget_alert_email, project_budget_alert_in_app }
 * PATCH / → update any subset of the above fields
 *
 * Guarded by:
 *   GET  → projects:read
 *   PATCH → projects:write
 */
import { Hono } from 'hono'
import type { AppEnv } from '../../types'
import { authMiddleware } from '../../middleware/auth'
import { requirePermission } from '../../middleware/guards'
import {
  createDb,
  getProjectSettings,
  updateProjectSettings,
  projectSettingsSchema,
} from '@zync/db/queries'

export const settingsProjectsRoute = new Hono<AppEnv>()

settingsProjectsRoute.use('*', authMiddleware)

// ── GET /api/settings/projects ────────────────────────────────────────────────

settingsProjectsRoute.get('/', requirePermission('projects:read'), async (c) => {
  const session = c.get('session')
  if (!session || session.type !== 'user' || !session.tid) {
    return c.json({ error: 'Unauthorized' }, 401)
  }

  const db = createDb(c.env)
  const settings = await getProjectSettings(db, session.tid)

  return c.json(settings, 200)
})

// ── PATCH /api/settings/projects ─────────────────────────────────────────────

settingsProjectsRoute.patch('/', requirePermission('projects:write'), async (c) => {
  const session = c.get('session')
  if (!session || session.type !== 'user' || !session.tid) {
    return c.json({ error: 'Unauthorized' }, 401)
  }

  const body = await c.req.json().catch(() => null)
  const parsed = projectSettingsSchema.safeParse(body)
  if (!parsed.success) {
    return c.json({ error: 'Validation failed', issues: parsed.error.issues }, 400)
  }

  const db = createDb(c.env)
  const updated = await updateProjectSettings(db, session.tid, parsed.data)

  return c.json(updated, 200)
})