accounted/app/api/suppliers/[id]/route.ts

import { createClient } from '@/lib/supabase/server'
import { NextResponse } from 'next/server'
import { validateBody } from '@/lib/api/validate'
import { UpdateSupplierSchema } from '@/lib/api/schemas'
import { requireCompanyId } from '@/lib/company/context'
import { requireWritePermission } from '@/lib/auth/require-write'

export async function GET(
  _request: Request,
  { params }: { params: Promise<{ id: string }> }
) {
  const supabase = await createClient()
  const { id } = await params

  const { data: { user } } = await supabase.auth.getUser()

  if (!user) {
    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
  }

  const companyId = await requireCompanyId(supabase, user.id)

  // Fetch supplier
  const { data: supplier, error } = await supabase
    .from('suppliers')
    .select('*')
    .eq('id', id)
    .eq('company_id', companyId)
    .single()

  if (error || !supplier) {
    return NextResponse.json({ error: 'Supplier not found' }, { status: 404 })
  }

  // Fetch stats: total outstanding & total paid
  const { data: invoices } = await supabase
    .from('supplier_invoices')
    .select('status, total, remaining_amount, paid_amount')
    .eq('supplier_id', id)
    .eq('company_id', companyId)

  const stats = {
    total_outstanding: 0,
    total_paid: 0,
    invoice_count: 0,
  }

  if (invoices) {
    stats.invoice_count = invoices.length
    for (const inv of invoices) {
      if (inv.status !== 'paid' && inv.status !== 'credited') {
        stats.total_outstanding += inv.remaining_amount || 0
      }
      stats.total_paid += inv.paid_amount || 0
    }
  }

  return NextResponse.json({ data: { ...supplier, stats } })
}

export async function PUT(
  request: Request,
  { params }: { params: Promise<{ id: string }> }
) {
  const supabase = await createClient()
  const { id } = await params

  const { data: { user } } = await supabase.auth.getUser()

  if (!user) {
    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
  }

  const writeCheck = await requireWritePermission(supabase, user.id)
  if (!writeCheck.ok) return writeCheck.response

  const companyId = await requireCompanyId(supabase, user.id)

  const result = await validateBody(request, UpdateSupplierSchema)
  if (!result.success) return result.response
  const body = result.data

  const { data, error } = await supabase
    .from('suppliers')
    .update({
      name: body.name,
      supplier_type: body.supplier_type,
      email: body.email,
      phone: body.phone,
      address_line1: body.address_line1,
      address_line2: body.address_line2,
      postal_code: body.postal_code,
      city: body.city,
      country: body.country,
      org_number: body.org_number,
      vat_number: body.vat_number,
      bankgiro: body.bankgiro,
      plusgiro: body.plusgiro,
      bank_account: body.bank_account,
      iban: body.iban,
      bic: body.bic,
      default_expense_account: body.default_expense_account,
      default_payment_terms: body.default_payment_terms,
      default_currency: body.default_currency,
      notes: body.notes,
    })
    .eq('id', id)
    .eq('company_id', companyId)
    .select()
    .single()

  if (error) {
    return NextResponse.json({ error: error.message }, { status: 500 })
  }

  return NextResponse.json({ data })
}

export async function DELETE(
  _request: Request,
  { params }: { params: Promise<{ id: string }> }
) {
  const supabase = await createClient()
  const { id } = await params

  const { data: { user } } = await supabase.auth.getUser()

  if (!user) {
    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
  }

  const writeCheck = await requireWritePermission(supabase, user.id)
  if (!writeCheck.ok) return writeCheck.response

  const companyId = await requireCompanyId(supabase, user.id)

  // Check for linked invoices
  const { count } = await supabase
    .from('supplier_invoices')
    .select('id', { count: 'exact', head: true })
    .eq('supplier_id', id)
    .eq('company_id', companyId)

  if (count && count > 0) {
    return NextResponse.json(
      { error: 'Kan inte ta bort leverantör med kopplade fakturor' },
      { status: 400 }
    )
  }

  const { error, count: deleteCount } = await supabase
    .from('suppliers')
    .delete({ count: 'exact' })
    .eq('id', id)
    .eq('company_id', companyId)

  if (error) {
    return NextResponse.json({ error: error.message }, { status: 500 })
  }

  if (deleteCount === 0) {
    return NextResponse.json({ error: 'Supplier not found' }, { status: 404 })
  }

  return NextResponse.json({ success: true })
}