/**
 * Vendor-attributed SLA (2026-06-02) — vendor collection CRUD.
 *
 *   GET  /api/vendors              list vendors (+ monitor counts)
 *   POST /api/vendors              create a vendor
 *
 * Scope: ADMIN + EDITOR may write; every authenticated user may read.
 * Mirrors the /api/maintenance-windows RBAC shape (the repo's dominant
 * session-based gate).
 */
import { NextResponse } from 'next/server';
import { getServerSession } from 'next-auth/next';
import { authOptions } from '@/lib/auth';
import { prisma } from '@/lib/prisma';
import { parseJsonBounded, BodyTooLargeError, BodyParseError } from '@/lib/api-helpers/parse-json';
import { createVendorSchema } from '@/lib/validations/vendor.schema';

const ROLES_WRITE = ['ADMIN', 'EDITOR'];

export async function GET() {
    const session = await getServerSession(authOptions);
    if (!session?.user?.id) {
        return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
    }

    const vendors = await prisma.vendor.findMany({
        where: { deletedAt: null },
        orderBy: { name: 'asc' },
        include: { _count: { select: { monitors: true } } },
    });

    return NextResponse.json({ success: true, vendors });
}

export async function POST(req: Request) {
    const session = await getServerSession(authOptions);
    if (!session?.user?.id) {
        return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
    }
    const role = (session.user as { role?: string }).role;
    if (!role || !ROLES_WRITE.includes(role)) {
        return NextResponse.json({ error: 'Forbidden' }, { status: 403 });
    }

    try {
        const raw = await parseJsonBounded<unknown>(req, { maxBytes: 64 * 1024 });
        const parsed = createVendorSchema.safeParse(raw);
        if (!parsed.success) {
            return NextResponse.json(
                { error: 'Invalid vendor', details: parsed.error.flatten() },
                { status: 400 },
            );
        }
        const data = parsed.data;

        const created = await prisma.vendor.create({
            data: {
                name: data.name,
                promisedUptime: data.promisedUptime,
                contractRef: data.contractRef ?? null,
                creditTerms: data.creditTerms ?? null,
                notes: data.notes ?? null,
                createdById: parseInt(session.user.id),
            },
        });

        return NextResponse.json({ success: true, vendor: created }, { status: 201 });
    } catch (error: unknown) {
        if (error instanceof BodyTooLargeError) {
            return NextResponse.json({ error: error.message }, { status: 413 });
        }
        if (error instanceof BodyParseError) {
            return NextResponse.json({ error: error.message }, { status: 400 });
        }
        console.error('Vendor create failed:', error);
        return NextResponse.json({ error: 'Internal Server Error' }, { status: 500 });
    }
}