/**
 * Proposal default settings routes — proposal-expiry-deadline (wave-12).
 * Mounted at /api/settings/proposals.
 *
 * GET  / → { proposal_default_valid_days }  (OWNER or ADMIN)
 * PUT  / → update proposal_default_valid_days  (OWNER only)
 */
import { Hono } from 'hono'
import type { AppEnv } from '../../types'
import { authMiddleware } from '../../middleware/auth'
import { getProposalSettings, updateProposalSettings } from '@zync/db/queries'
import { proposalDefaultsBodySchema } from '@zync/types'

export const proposalSettingsRoute = new Hono<AppEnv>()

proposalSettingsRoute.use('*', authMiddleware)

// GET /api/settings/proposals
proposalSettingsRoute.get('/', async (c) => {
  const session = c.get('session')
  if (!session || session.type !== 'user' || !session.tid) {
    return c.json({ error: 'Unauthorized' }, 401)
  }

  // Require OWNER or ADMIN role
  const role = session.role ?? ''
  if (!['OWNER', 'ADMIN'].includes(role)) {
    return c.json({ error: 'Forbidden' }, 403)
  }

  const db = c.get('db')
  const settings = await getProposalSettings(db, session.tid)
  return c.json(settings, 200)
})

// PUT /api/settings/proposals
proposalSettingsRoute.put('/', async (c) => {
  const session = c.get('session')
  if (!session || session.type !== 'user' || !session.tid) {
    return c.json({ error: 'Unauthorized' }, 401)
  }

  // Require OWNER role only
  const role = session.role ?? ''
  if (role !== 'OWNER') {
    return c.json({ error: 'Forbidden' }, 403)
  }

  const body = await c.req.json().catch(() => null)
  const parsed = proposalDefaultsBodySchema.safeParse(body)
  if (!parsed.success) {
    return c.json({ error: 'Validation failed', issues: parsed.error.issues }, 400)
  }

  const db = c.get('db')
  const updated = await updateProposalSettings(db, session.tid, {
    proposal_default_valid_days: parsed.data.proposal_default_valid_days,
  })
  return c.json(updated, 200)
})