import { NextResponse } from "next/server";
import { createClient } from "@/lib/supabase-server";
import { canCompany, getCompanyContext } from "@/lib/company-context";
import { mudarStatusDoPedido, type CorpoDaMudancaDeStatus } from "@/lib/orders/mudar-status.server";

export const runtime = "nodejs";

/* O trabalho (travas, rastro de produção, histórico) mora em
   lib/orders/mudar-status.server.ts, que o assistente também usa. */

async function getAuth() {
  const supabase = await createClient();
  const {
    data: { user },
  } = await supabase.auth.getUser();
  return { supabase, user };
}

export async function POST(req: Request) {
  const { supabase, user } = await getAuth();
  if (!user) return NextResponse.json({ error: "Nao autenticado." }, { status: 401 });

  const companyCtx = await getCompanyContext(supabase, user);
  if (!canCompany(companyCtx, user.id, "orders.write")) {
    return NextResponse.json({ error: "Sem permissao." }, { status: 403 });
  }

  const body = (await req.json().catch(() => null)) as CorpoDaMudancaDeStatus;
  const resultado = await mudarStatusDoPedido(supabase, user, companyCtx, body);
  return NextResponse.json(resultado.corpo, { status: resultado.status });
}