import { NextResponse } from 'next/server' import { db } from '@/lib/db' export const dynamic = 'force-dynamic' // GET /api/aos/crm/companies/[id] — full company detail with timeline export async function GET( _req: Request, { params }: { params: Promise<{ id: string }> } ) { const { id } = await params const company = await db.company.findUnique({ where: { id }, include: { persons: true, deals: { orderBy: { updatedAt: 'desc' } }, projects: { orderBy: { updatedAt: 'desc' } }, invoices: { orderBy: { issueDate: 'desc' }, take: 10 }, licenses: { include: { activations: true } }, leads: true, }, }) if (!company) return NextResponse.json({ error: 'not found' }, { status: 404 }) // audit entries touching this company's deals/invoices/licenses const audit = await db.auditLog.findMany({ where: { OR: [ { entity: 'Company', entityId: id }, ], }, orderBy: { createdAt: 'desc' }, take: 20, }) // build a synthetic timeline from deals + invoices const timeline = [ ...company.deals.map((d) => ({ kind: 'deal', date: d.updatedAt, title: d.title, meta: d.stage, valueCents: d.valueCents })), ...company.invoices.map((i) => ({ kind: 'invoice', date: i.issueDate, title: i.number, meta: i.status, valueCents: i.grossCents })), ...company.projects.map((p) => ({ kind: 'project', date: p.updatedAt, title: p.name, meta: p.status, valueCents: p.fixedPriceCents })), ].sort((a, b) => new Date(b.date).getTime() - new Date(a.date).getTime()) // DSGVO consent record (synthetic from source + tags) const consent = { legalBasis: 'Art. 6 Abs. 1 lit. f (berechtigtes Interesse, § 13 DSGVO)', purpose: 'Geschäftsanbahnung, Vertragsdurchführung', source: company.source ?? 'manuell erfasst', recordedAt: company.createdAt, evidence: company.source === 'lead-finder' ? 'Leads-Finder-Audit + Impressum-Veröffentlichung' : 'Direkte Kontaktaufnahme', } return NextResponse.json({ company, timeline, audit, consent }) }