import { NextResponse } from "next/server";
import { createClient } from "@/lib/supabase-server";
import { canCompany, getCompanyContext } from "@/lib/company-context";

export async function GET(req: Request) {
  const supabase = await createClient();
  const {
    data: { user },
  } = await supabase.auth.getUser();

  if (!user) return NextResponse.json({ error: "Não autenticado." }, { status: 401 });

  const ctx = await getCompanyContext(supabase, user);
  if (!canCompany(ctx, user.id, "commissions.read")) {
    return NextResponse.json({ error: "Sem permissão." }, { status: 403 });
  }

  const { searchParams } = new URL(req.url);
  const entityType = searchParams.get("entity_type")?.trim() || "";

  let query = supabase
    .from("commission_audit_log")
    .select("id,entity_type,entity_id,action,before_payload,after_payload,reason,actor_user_id,created_at")
    .eq("company_id", ctx.companyId)
    .order("created_at", { ascending: false })
    .limit(200);

  if (entityType) {
    query = query.eq("entity_type", entityType);
  }

  const { data: logs, error } = await query;
  if (error) {
    return NextResponse.json({ error: "Falha ao listar auditoria de comissão." }, { status: 500 });
  }

  const actorIds = Array.from(new Set((logs ?? []).map((log) => log.actor_user_id).filter(Boolean)));
  const { data: actors } = actorIds.length
    ? await supabase.from("company_users").select("user_id,email,role").eq("company_id", ctx.companyId).in("user_id", actorIds)
    : { data: [] };

  const actorMap = new Map(
    ((actors ?? []) as Array<{ user_id: string; email: string; role: string }>).map((actor) => [actor.user_id, actor])
  );

  return NextResponse.json({
    logs: (logs ?? []).map((log) => ({
      ...log,
      actor_email: log.actor_user_id ? actorMap.get(log.actor_user_id)?.email || null : null,
      actor_role: log.actor_user_id ? actorMap.get(log.actor_user_id)?.role || null : null,
    })),
  });
}