AOS/src/app/api/aos/agency/[id]/reject/route.ts

import { NextResponse } from 'next/server'
import { db } from '@/lib/db'
import { z } from 'zod'

export const dynamic = 'force-dynamic'

const schema = z.object({
  reason: z.string().min(1).max(500),
  reviewedBy: z.string().optional(),
})

// PATCH /api/aos/agency/[id]/reject
// Admin rejects an agency application. Sets Company.agencyStatus = "rejected".
export async function PATCH(req: Request, { params }: { params: Promise<{ id: string }> }) {
  try {
    const { id } = await params
    const parsed = schema.safeParse(await req.json())
    if (!parsed.success) {
      return NextResponse.json({ error: 'reason required', details: parsed.error.flatten() }, { status: 400 })
    }
    const { reason, reviewedBy } = parsed.data

    const application = await db.agencyApplication.findUnique({
      where: { id },
      include: { company: true },
    })
    if (!application) {
      return NextResponse.json({ error: 'application not found' }, { status: 404 })
    }

    const now = new Date()
    await db.$transaction([
      db.agencyApplication.update({
        where: { id },
        data: {
          status: 'rejected',
          rejectReason: reason,
          reviewedBy: reviewedBy ?? 'admin:ui',
          reviewedAt: now,
        },
      }),
      db.company.update({
        where: { id: application.companyId },
        data: {
          agencyStatus: 'rejected',
          agencyRejectedAt: now,
          agencyRejectReason: reason,
        },
      }),
    ])

    await db.auditLog.create({
      data: {
        actor: reviewedBy ?? 'admin:ui',
        action: 'agency.reject',
        entity: 'AgencyApplication',
        entityId: id,
        after: JSON.stringify({ company: application.company.name, reason }),
        hash: 'sha256:' + Math.random().toString(36).slice(2),
      },
    })

    // Send rejection email
    const { sendAgencyRejectedEmail } = await import('@/lib/email')
    if (application.company.email) {
      await sendAgencyRejectedEmail({
        to: application.company.email,
        companyName: application.company.name,
        reason,
      })
    }

    return NextResponse.json({ ok: true, status: 'rejected', reason })
  } catch (err) {
    const msg = err instanceof Error ? err.message : 'internal server error'
    return NextResponse.json({ error: msg }, { status: 500 })
  }
}