import type { APIRoute } from 'astro'
import { getDb } from '../../../lib/db'
import {
  validateBearer, unauthorizedResponse, badRequestResponse,
  jsonResponse, hasForbiddenFields,
} from '../../../lib/auth'

export const GET: APIRoute = ({ url }) => {
  const db = getDb()
  const params = url.searchParams
  const published = params.get('published')
  const limit = parseInt(params.get('limit') ?? '100', 10)

  let query = 'SELECT * FROM articles WHERE 1=1'
  const args: (string | number)[] = []

  if (published !== null) { query += ' AND published = ?'; args.push(parseInt(published)) }
  query += ' ORDER BY published_at DESC LIMIT ?'
  args.push(limit)

  return jsonResponse(db.prepare(query).all(...args))
}

export const POST: APIRoute = async ({ request }) => {
  if (!validateBearer(request)) return unauthorizedResponse()

  let body: Record<string, unknown>
  try { body = await request.json() } catch { return badRequestResponse('Invalid JSON') }

  if (hasForbiddenFields(body)) return badRequestResponse('Forbidden field in request')

  if (!body.slug || !body.title) return badRequestResponse('Missing slug or title')

  const db = getDb()

  try {
    const result = db.prepare(`
      INSERT INTO articles (slug, title, content_sv, category, featured, published, published_at, meta_title, meta_desc)
      VALUES (@slug, @title, @content_sv, @category, @featured, @published, @published_at, @meta_title, @meta_desc)
    `).run({
      slug: body.slug,
      title: body.title,
      content_sv: body.content_sv ?? null,
      category: body.category ?? null,
      featured: body.featured ?? 0,
      published: body.published ?? 0,
      published_at: body.published_at ?? null,
      meta_title: body.meta_title ?? null,
      meta_desc: body.meta_desc ?? null,
    })

    return jsonResponse({ success: true, id: result.lastInsertRowid }, 201)
  } catch (e: unknown) {
    const msg = e instanceof Error ? e.message : 'Unknown error'
    if (msg.includes('UNIQUE')) return badRequestResponse('Slug already exists')
    return jsonResponse({ error: msg }, 500)
  }
}