import { NextResponse } from "next/server";
import { createAdminClient, createClient } from "@/lib/supabase-server";
import { canCompany, getCompanyContext } from "@/lib/company-context";

export const runtime = "nodejs";

export async function DELETE(_req: Request, ctx: { params: Promise<{ id: string }> }) {
  const params = await ctx.params;
  const catalogOrderId = params.id;
  const supabase = await createClient();
  const {
    data: { user },
  } = await supabase.auth.getUser();

  if (!user) {
    return NextResponse.json({ error: "Não autenticado." }, { status: 401 });
  }

  const companyCtx = await getCompanyContext(supabase, user);
  if (!canCompany(companyCtx, user.id, "catalog.orders.write")) {
    return NextResponse.json({ error: "Sem permissão." }, { status: 403 });
  }

  const tenantIds = (companyCtx.tenantIds?.length ? companyCtx.tenantIds : [user.id]).filter(
    (id): id is string => typeof id === "string" && id.length > 0
  );

  const admin = createAdminClient();
  const { data: existing, error: existingError } = await admin
    .from("catalog_orders")
    .select("id,user_id")
    .eq("id", catalogOrderId)
    .in("user_id", tenantIds)
    .maybeSingle();

  if (existingError) {
    return NextResponse.json({ error: existingError.message }, { status: 400 });
  }

  if (!existing?.id) {
    return NextResponse.json({ error: "Pedido do catálogo não encontrado." }, { status: 404 });
  }

  const { error: deleteError } = await admin
    .from("catalog_orders")
    .delete()
    .eq("id", catalogOrderId)
    .eq("user_id", String(existing.user_id));

  if (deleteError) {
    return NextResponse.json({ error: deleteError.message }, { status: 400 });
  }

  return NextResponse.json({ ok: true });
}