import { NextResponse } from "next/server";
import { createAdminClient, createClient } from "@/lib/supabase-server";
import { canCompany, canReadFinancialLookup, getCompanyContext } from "@/lib/company-context";

export async function GET() {
  const supabase = await createClient();
  const {
    data: { user },
    error: userError,
  } = await supabase.auth.getUser();

  if (userError || !user) {
    return NextResponse.json({ error: "Não autenticado." }, { status: 401 });
  }

  const ctx = await getCompanyContext(supabase, user);
  /* Consulta de apoio: quem pode ler qualquer tela do Financeiro pode ver
     esta lista. Exigir a chave da tela propria esvaziava as telas vizinhas
     que dependem dela — ver `canReadFinancialLookup`. */
  if (!canReadFinancialLookup(ctx, user.id)) {
    return NextResponse.json({ error: "Sem permissão." }, { status: 403 });
  }

  const admin = createAdminClient();
  const { data, error } = await admin
    .from("financial_categories")
    .select("*")
    .eq("company_id", ctx.companyId)
    .order("name");

  if (error) {
    return NextResponse.json({ error: error.message }, { status: 400 });
  }

  return NextResponse.json({ categories: data });
}

export async function POST(req: Request) {
  const supabase = await createClient();
  const {
    data: { user },
    error: userError,
  } = await supabase.auth.getUser();

  if (userError || !user) {
    return NextResponse.json({ error: "Não autenticado." }, { status: 401 });
  }

  const ctx = await getCompanyContext(supabase, user);
  if (!canCompany(ctx, user.id, "financial.payables.write")) {
    return NextResponse.json({ error: "Sem permissão." }, { status: 403 });
  }

  const body = await req.json();
  const { name, icon } = body;

  if (!name || !icon) {
    return NextResponse.json({ error: "Nome e ícone são obrigatórios." }, { status: 400 });
  }

  const admin = createAdminClient();
  const { data, error } = await admin
    .from("financial_categories")
    .insert({
      company_id: ctx.companyId,
      name,
      icon,
      type: "expense"
    })
    .select()
    .single();

  if (error) {
    return NextResponse.json({ error: error.message }, { status: 400 });
  }

  return NextResponse.json({ category: data });
}