import type { APIRoute } from 'astro'
import { getDb } from '../../../lib/db'
import {
  validateBearer, unauthorizedResponse, badRequestResponse,
  jsonResponse, hasForbiddenFields,
} from '../../../lib/auth'
import { purgeCloudflareCache } from '../../../lib/cloudflare'

export const GET: APIRoute = ({ url }) => {
  const db = getDb()
  const params = url.searchParams
  const active = params.get('active')
  const featured = params.get('featured')
  const limit = parseInt(params.get('limit') ?? '100', 10)

  let query = 'SELECT * FROM casinos WHERE 1=1'
  const args: (string | number)[] = []

  if (active !== null) { query += ' AND active = ?'; args.push(parseInt(active)) }
  if (featured !== null) { query += ' AND featured = ?'; args.push(parseInt(featured)) }
  query += ' ORDER BY rating DESC LIMIT ?'
  args.push(limit)

  const casinos = db.prepare(query).all(...args)
  return jsonResponse(casinos)
}

export const POST: APIRoute = async ({ request }) => {
  if (!validateBearer(request)) return unauthorizedResponse()

  let body: Record<string, unknown>
  try { body = await request.json() } catch { return badRequestResponse('Invalid JSON') }

  if (hasForbiddenFields(body)) {
    return badRequestResponse('Promo codes are not allowed on this platform')
  }

  const required = ['slug', 'brand', 'rating']
  for (const f of required) {
    if (!body[f]) return badRequestResponse(`Missing required field: ${f}`)
  }

  const db = getDb()

  try {
    const result = db.prepare(`
      INSERT INTO casinos (
        slug, brand, rating, founded, license, min_deposit, bonus_amount,
        bonus_wagering, payout_speed, payment_methods, categories,
        pay_n_play, featured, featured_order, affiliate_url,
        content_sv, meta_title, meta_desc, active
      ) VALUES (
        @slug, @brand, @rating, @founded, @license, @min_deposit, @bonus_amount,
        @bonus_wagering, @payout_speed, @payment_methods, @categories,
        @pay_n_play, @featured, @featured_order, @affiliate_url,
        @content_sv, @meta_title, @meta_desc, @active
      )
    `).run({
      slug: body.slug,
      brand: body.brand,
      rating: body.rating,
      founded: body.founded ?? null,
      license: body.license ?? null,
      min_deposit: body.min_deposit ?? null,
      bonus_amount: body.bonus_amount ?? null,
      bonus_wagering: body.bonus_wagering ?? null,
      payout_speed: body.payout_speed ?? null,
      payment_methods: typeof body.payment_methods === 'object'
        ? JSON.stringify(body.payment_methods) : (body.payment_methods ?? '[]'),
      categories: typeof body.categories === 'object'
        ? JSON.stringify(body.categories) : (body.categories ?? '[]'),
      pay_n_play: body.pay_n_play ?? 0,
      featured: body.featured ?? 0,
      featured_order: body.featured_order ?? 999,
      affiliate_url: body.affiliate_url ?? null,
      content_sv: body.content_sv ?? null,
      meta_title: body.meta_title ?? null,
      meta_desc: body.meta_desc ?? null,
      active: body.active ?? 1,
    })

    return jsonResponse({ success: true, id: result.lastInsertRowid }, 201)
  } catch (e: unknown) {
    const msg = e instanceof Error ? e.message : 'Unknown error'
    if (msg.includes('UNIQUE')) return badRequestResponse('Slug already exists')
    return jsonResponse({ error: msg }, 500)
  }
}