import { NextResponse } from "next/server";
import { db } from "@/lib/db";
import { getCurrentUser } from "@/lib/auth";
import { can, getMembership } from "@/lib/rbac";
import { audit } from "@/lib/audit";

/**
 * Integration API for badge scanners / kiosk apps:
 * POST { regCode } → checks the attendee in. Requires an authenticated session
 * with checkin.perform on the registration's conference.
 */
export async function POST(req: Request) {
  const user = await getCurrentUser();
  if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });

  const body = await req.json().catch(() => null);
  const regCode = String(body?.regCode ?? "").toUpperCase().trim();
  if (!regCode) return NextResponse.json({ error: "regCode required" }, { status: 400 });

  const reg = await db.registration.findUnique({
    where: { regCode },
    include: { ticketType: true, checkIns: { where: { type: "CONFERENCE" } } },
  });
  if (!reg) return NextResponse.json({ error: "Registration not found" }, { status: 404 });

  const membership = await getMembership(user.id, reg.conferenceId);
  if (!can(membership, "checkin.perform")) return NextResponse.json({ error: "Forbidden" }, { status: 403 });

  if (reg.status !== "CONFIRMED") {
    return NextResponse.json({ error: `Registration is ${reg.status}`, registration: { name: reg.name, status: reg.status } }, { status: 409 });
  }
  if (reg.checkIns.length > 0) {
    return NextResponse.json({ error: "Already checked in", checkedInAt: reg.checkIns[0].createdAt }, { status: 409 });
  }

  const checkIn = await db.checkIn.create({ data: { registrationId: reg.id, type: "CONFERENCE", checkedInBy: user.name } });
  await audit({ userId: user.id, conferenceId: reg.conferenceId, action: "checkin.api", entity: "Registration", entityId: reg.id });
  return NextResponse.json({
    ok: true,
    registration: { name: reg.name, ticket: reg.ticketType.name, mode: reg.mode, regCode: reg.regCode },
    checkedInAt: checkIn.createdAt,
  });
}