/**
 * Time-tracking settings routes — time-management.
 * Mounted at /api/settings/time-tracking.
 *
 * GET  / → spec-backed tenant time tracking settings
 * PATCH / → update any subset of the time tracking settings surface
 */
import { Hono } from 'hono'
import { z } from 'zod'
import type { AppEnv } from '../../types'
import { authMiddleware } from '../../middleware/auth'
import { requirePermission } from '../../middleware/guards'
import { getTimeTrackingSettings, updateTimeTrackingSettings } from '@zync/time'

const patchTimeSettingsSchema = z.object({
  time_rounding: z
    .enum(['none', 'nearest_5', 'nearest_15', 'nearest_30', 'up_15', 'up_30'])
    .optional(),
  time_min_billable_minutes: z.number().int().min(0).optional(),
  time_idle_threshold_minutes: z.number().int().min(5).max(60).optional(),
  time_auto_pause_on_idle: z.boolean().optional(),
  time_standard_hours_per_day: z.number().min(0.25).max(24).optional(),
  time_flag_overtime: z.boolean().optional(),
  time_require_overtime_approval: z.boolean().optional(),
  contractor_time_enabled: z.boolean().optional(),
  mileage_enabled: z.boolean().optional(),
  time_magic_link_enabled: z.boolean().optional(),
})

export const timeTrackingSettingsRoute = new Hono<AppEnv>()

timeTrackingSettingsRoute.use('*', authMiddleware)

// ── GET /api/settings/time-tracking ──────────────────────────────────────────

timeTrackingSettingsRoute.get('/', requirePermission('settings:read'), async (c) => {
  const session = c.get('session')
  if (!session || session.type !== 'user' || !session.tid) {
    return c.json({ error: 'Unauthorized' }, 401)
  }

  const db = c.get('db')
  const settings = await getTimeTrackingSettings(db, session.tid)

  return c.json(settings, 200)
})

// ── PATCH /api/settings/time-tracking ────────────────────────────────────────

timeTrackingSettingsRoute.patch(
  '/',
  requirePermission('settings:write'),
  async (c) => {
    const session = c.get('session')
    if (!session || session.type !== 'user' || !session.tid) {
      return c.json({ error: 'Unauthorized' }, 401)
    }

    const body = await c.req.json().catch(() => null)
    const parsed = patchTimeSettingsSchema.safeParse(body)
    if (!parsed.success) {
      return c.json({ error: 'Validation failed', issues: parsed.error.issues }, 400)
    }

    const db = c.get('db')
    const updated = await updateTimeTrackingSettings(db, session.tid, parsed.data)

    return c.json(updated, 200)
  },
)