a6c0f3de-eeb0-4d76-a57f-f600dd133c06

src/app/api/aos/agency/[id]/reject/route.ts

@@ -0,0 +1,68 @@
+import { NextResponse } from 'next/server'
+import { db } from '@/lib/db'
+import { z } from 'zod'
+
+export const dynamic = 'force-dynamic'
+
+const schema = z.object({
+  reason: z.string().min(1).max(500),
+  reviewedBy: z.string().optional(),
+})
+
+// PATCH /api/aos/agency/[id]/reject
+// Admin rejects an agency application. Sets Company.agencyStatus = "rejected".
+export async function PATCH(req: Request, { params }: { params: Promise<{ id: string }> }) {
+  try {
+    const { id } = await params
+    const parsed = schema.safeParse(await req.json())
+    if (!parsed.success) {
+      return NextResponse.json({ error: 'reason required', details: parsed.error.flatten() }, { status: 400 })
+    }
+    const { reason, reviewedBy } = parsed.data
+
+    const application = await db.agencyApplication.findUnique({
+      where: { id },
+      include: { company: true },
+    })
+    if (!application) {
+      return NextResponse.json({ error: 'application not found' }, { status: 404 })
+    }
+
+    const now = new Date()
+    await db.$transaction([
+      db.agencyApplication.update({
+        where: { id },
+        data: {
+          status: 'rejected',
+          rejectReason: reason,
+          reviewedBy: reviewedBy ?? 'admin:ui',
+          reviewedAt: now,
+        },
+      }),
+      db.company.update({
+        where: { id: application.companyId },
+        data: {
+          agencyStatus: 'rejected',
+          agencyRejectedAt: now,
+          agencyRejectReason: reason,
+        },
+      }),
+    ])
+
+    await db.auditLog.create({
+      data: {
+        actor: reviewedBy ?? 'admin:ui',
+        action: 'agency.reject',
+        entity: 'AgencyApplication',
+        entityId: id,
+        after: JSON.stringify({ company: application.company.name, reason }),
+        hash: 'sha256:' + Math.random().toString(36).slice(2),
+      },
+    })
+
+    return NextResponse.json({ ok: true, status: 'rejected', reason })
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : 'internal server error'
+    return NextResponse.json({ error: msg }, { status: 500 })
+  }
+}