import type { APIRoute } from 'astro'
import { getDb } from '../../../lib/db'
import {
  validateBearer, unauthorizedResponse, badRequestResponse,
  jsonResponse, notFoundResponse, hasForbiddenFields,
} from '../../../lib/auth'

export const GET: APIRoute = ({ params }) => {
  const db = getDb()
  const cat = db.prepare('SELECT * FROM categories WHERE slug = ?').get(params.slug)
  if (!cat) return notFoundResponse()
  return jsonResponse(cat)
}

export const PUT: APIRoute = async ({ params, request }) => {
  if (!validateBearer(request)) return unauthorizedResponse()

  let body: Record<string, unknown>
  try { body = await request.json() } catch { return badRequestResponse('Invalid JSON') }

  if (hasForbiddenFields(body)) return badRequestResponse('Forbidden field')

  const db = getDb()
  const existing = db.prepare('SELECT id FROM categories WHERE slug = ?').get(params.slug)
  if (!existing) return notFoundResponse()

  const allowed = ['name_sv', 'description_sv', 'meta_title', 'meta_desc', 'active']
  const updates: string[] = []
  const values: unknown[] = []

  for (const key of allowed) {
    if (key in body) {
      updates.push(`${key} = ?`)
      values.push(body[key])
    }
  }

  if (updates.length === 0) return badRequestResponse('No valid fields to update')

  values.push(params.slug)
  db.prepare(`UPDATE categories SET ${updates.join(', ')} WHERE slug = ?`).run(...values)
  return jsonResponse({ success: true })
}