import { NextResponse } from 'next/server';
import { z } from 'zod';
import { db } from '@/lib/db';
import { getSession } from '@/lib/auth';
import { canAccessClass } from '@/lib/access-policy';

const createDrawingSchema = z.object({
  title: z.string().min(1).default('Untitled Drawing'),
  description: z.string().optional(),
  drawingData: z.string().min(1),
  imageData: z.string().optional(),
  schoolId: z.string().optional(),
  subjectId: z.string().optional(),
  classGroupId: z.string().optional(),
  isPublic: z.boolean().default(false),
});

export async function GET(request: Request) {
  try {
    const session = await getSession();
    if (!session) {
      return NextResponse.json({ error: 'Not authenticated' }, { status: 401 });
    }

    const { searchParams } = new URL(request.url);
    const schoolId = searchParams.get('schoolId') ?? session.user?.schoolId ?? undefined;
    const subjectId = searchParams.get('subjectId');

    const where: Record<string, unknown> = {};
    if (schoolId) {
      where.schoolId = schoolId;
    }
    if (subjectId) {
      where.subjectId = subjectId;
    }

    // Show own drawings + public drawings from the same school
    const drawings = await db.drawing.findMany({
      where: {
        OR: [
          { ownerId: session.userId },
          { isPublic: true, ...(schoolId ? { schoolId } : {}) },
        ],
        ...(subjectId ? { subjectId } : {}),
      },
      orderBy: { updatedAt: 'desc' },
    });

    return NextResponse.json(drawings);
  } catch (error) {
    console.error('Drawings GET error:', error);
    return NextResponse.json(
      { error: 'Internal server error' },
      { status: 500 }
    );
  }
}

export async function POST(request: Request) {
  try {
    const session = await getSession();
    if (!session) {
      return NextResponse.json({ error: 'Not authenticated' }, { status: 401 });
    }

    const body = await request.json();
    const parsed = createDrawingSchema.safeParse(body);
    if (!parsed.success) {
      return NextResponse.json(
        { error: 'Validation failed', details: parsed.error.issues },
        { status: 400 }
      );
    }

    if (parsed.data.schoolId && session.user?.role !== 'SUPER_ADMIN' && parsed.data.schoolId !== session.user?.schoolId) {
      return NextResponse.json({ error: 'Forbidden' }, { status: 403 });
    }
    if (parsed.data.classGroupId && (!session.user || !(await canAccessClass(session.user, parsed.data.classGroupId)))) {
      return NextResponse.json({ error: 'Forbidden' }, { status: 403 });
    }
    if (session.user?.role === 'STUDENT' && parsed.data.isPublic) {
      return NextResponse.json({ error: 'Students cannot publish drawings to a class' }, { status: 403 });
    }

    const drawing = await db.drawing.create({
      data: {
        schoolId: parsed.data.schoolId ?? session.user?.schoolId ?? 'default',
        ownerId: session.userId,
        title: parsed.data.title,
        description: parsed.data.description ?? null,
        drawingData: parsed.data.drawingData,
        imageData: parsed.data.imageData ?? null,
        subjectId: parsed.data.subjectId ?? null,
        classGroupId: parsed.data.classGroupId ?? null,
        isPublic: parsed.data.isPublic,
      },
    });

    return NextResponse.json(drawing, { status: 201 });
  } catch (error) {
    console.error('Drawings POST error:', error);
    return NextResponse.json(
      { error: 'Internal server error' },
      { status: 500 }
    );
  }
}