import { NextResponse } from "next/server";
import { createAdminClient, createClient } from "@/lib/supabase-server";
import { canCompany, getCompanyContext } from "@/lib/company-context";

/* Lista do que pode ser gravado. Antes o corpo da requisicao era repassado
   inteiro para o banco, entao qualquer campo que alguem mandasse entrava — e o
   erro nao aparece na hora, aparece quando um valor estranho vira custo. */
const CAMPOS_DA_MAQUINA = new Set([
  "name", "description", "hourly_cost", "setup_minutes_default", "is_active", "notes",
  "acquisition_value", "useful_life_years", "residual_value", "power_kw",
  "energy_cost_kwh", "maintenance_monthly", "productive_hours_month", "hourly_cost_manual",
]);

const CAMPOS_DO_CARGO = new Set([
  "role_name", "description", "hourly_rate", "efficiency_pct", "is_active",
  "monthly_salary", "charges_percent", "productive_hours_month", "hourly_rate_manual",
]);

function somenteCamposConhecidos(tipo: string, dados: Record<string, unknown>) {
  const permitidos = tipo === "machine" ? CAMPOS_DA_MAQUINA : CAMPOS_DO_CARGO;
  const limpo: Record<string, unknown> = {};
  for (const [chave, valor] of Object.entries(dados)) {
    if (permitidos.has(chave)) limpo[chave] = valor;
  }
  return limpo;
}

export async function GET(req: Request) {
  const { supabase, user } = await getAuth();
  if (!user) return NextResponse.json({ error: "Não autenticado." }, { status: 401 });

  const ctx = await getCompanyContext(supabase, user);
  if (!canCompany(ctx, user.id, "production.read")) {
    return NextResponse.json({ error: "Sem permissão." }, { status: 403 });
  }

  const { searchParams } = new URL(req.url);
  const type = searchParams.get("type"); // 'machines' | 'roles'

  const adminSupabase = createAdminClient();
  let query;

  if (type === 'machines') {
    query = adminSupabase.from("machines").select("*").eq("user_id", ctx.companyId).order("name");
  } else if (type === 'roles') {
    query = adminSupabase.from("labor_roles").select("*").eq("user_id", ctx.companyId).order("role_name");
  } else {
    return NextResponse.json({ error: "Tipo inválido." }, { status: 400 });
  }

  const { data, error } = await query;

  if (error) return NextResponse.json({ error: error.message }, { status: 400 });

  return NextResponse.json(data);
}

export async function POST(req: Request) {
  const { supabase, user } = await getAuth();
  if (!user) return NextResponse.json({ error: "Não autenticado." }, { status: 401 });

  const ctx = await getCompanyContext(supabase, user);
  if (!canCompany(ctx, user.id, "production.costs.write")) {
    return NextResponse.json({ error: "Sem permissão." }, { status: 403 });
  }

  const body = await req.json();
  const { type, ...payload } = body; // type: 'machine' | 'role'

  const adminSupabase = createAdminClient();
  let table = "";
  
  if (type === 'machine') {
    table = "machines";
  } else if (type === 'role') {
    table = "labor_roles";
  } else {
    return NextResponse.json({ error: "Tipo inválido." }, { status: 400 });
  }

  const { data, error } = await adminSupabase
    .from(table)
    .insert({
      ...somenteCamposConhecidos(type, payload),
      user_id: ctx.companyId,
    })
    .select()
    .single();

  if (error) {
    console.error(`Insert error (${type}):`, error);
    return NextResponse.json({ error: error.message }, { status: 400 });
  }

  return NextResponse.json(data);
}

export async function PUT(req: Request) {
  const { supabase, user } = await getAuth();
  if (!user) return NextResponse.json({ error: "Não autenticado." }, { status: 401 });

  const ctx = await getCompanyContext(supabase, user);
  if (!canCompany(ctx, user.id, "production.costs.write")) {
    return NextResponse.json({ error: "Sem permissão." }, { status: 403 });
  }

  const body = await req.json();
  const { type, id, ...updates } = body;

  const adminSupabase = createAdminClient();
  let table = "";
  
  if (type === 'machine') {
    table = "machines";
  } else if (type === 'role') {
    table = "labor_roles";
  } else {
    return NextResponse.json({ error: "Tipo inválido." }, { status: 400 });
  }

  const { data, error } = await adminSupabase
    .from(table)
    .update(somenteCamposConhecidos(type, updates))
    .eq("id", id)
    .eq("user_id", ctx.companyId)
    .select()
    .single();

  if (error) return NextResponse.json({ error: error.message }, { status: 400 });

  return NextResponse.json(data);
}

export async function DELETE(req: Request) {
  const { supabase, user } = await getAuth();
  if (!user) return NextResponse.json({ error: "Não autenticado." }, { status: 401 });

  const ctx = await getCompanyContext(supabase, user);
  if (!canCompany(ctx, user.id, "production.costs.write")) {
    return NextResponse.json({ error: "Sem permissão." }, { status: 403 });
  }

  const { searchParams } = new URL(req.url);
  const id = searchParams.get("id");
  const type = searchParams.get("type");

  if (!id || !type) return NextResponse.json({ error: "Dados incompletos." }, { status: 400 });

  const adminSupabase = createAdminClient();
  let table = "";
  if (type === 'machine') table = "machines";
  else if (type === 'role') table = "labor_roles";
  else return NextResponse.json({ error: "Tipo inválido." }, { status: 400 });

  const { error } = await adminSupabase
    .from(table)
    .delete()
    .eq("id", id)
    .eq("user_id", ctx.companyId);

  if (error) return NextResponse.json({ error: error.message }, { status: 400 });

  return NextResponse.json({ ok: true });
}

async function getAuth() {
  const supabase = await createClient();
  const {
    data: { user },
  } = await supabase.auth.getUser();
  return { supabase, user };
}