import type { APIRoute } from 'astro'
import { getDb } from '../../../lib/db'
import {
  validateBearer, unauthorizedResponse, badRequestResponse,
  jsonResponse, hasForbiddenFields,
} from '../../../lib/auth'

export const GET: APIRoute = () => {
  const db = getDb()
  return jsonResponse(db.prepare('SELECT * FROM categories WHERE active = 1').all())
}

export const POST: APIRoute = async ({ request }) => {
  if (!validateBearer(request)) return unauthorizedResponse()

  let body: Record<string, unknown>
  try { body = await request.json() } catch { return badRequestResponse('Invalid JSON') }

  if (hasForbiddenFields(body)) return badRequestResponse('Forbidden field')

  if (!body.slug || !body.name_sv) return badRequestResponse('Missing slug or name_sv')

  const db = getDb()

  try {
    const result = db.prepare(`
      INSERT INTO categories (slug, name_sv, description_sv, meta_title, meta_desc, active)
      VALUES (@slug, @name_sv, @description_sv, @meta_title, @meta_desc, @active)
    `).run({
      slug: body.slug,
      name_sv: body.name_sv,
      description_sv: body.description_sv ?? null,
      meta_title: body.meta_title ?? null,
      meta_desc: body.meta_desc ?? null,
      active: body.active ?? 1,
    })

    return jsonResponse({ success: true, id: result.lastInsertRowid }, 201)
  } catch (e: unknown) {
    const msg = e instanceof Error ? e.message : 'Unknown error'
    if (msg.includes('UNIQUE')) return badRequestResponse('Slug already exists')
    return jsonResponse({ error: msg }, 500)
  }
}