import { NextResponse } from "next/server";
import { prisma } from "@/lib/prisma";
import { requireRole } from "@/lib/auth";
import { mapPunchToPerson } from "@/lib/device-punch";

/** Admin maps an UNMATCHED punch to a student or staff member — the
    identifier is remembered and all its pending punches are applied. */
export async function POST(req: Request) {
  const session = await requireRole("INSTITUTION_ADMIN");
  if (!session?.institutionId) {
    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
  }
  const body = (await req.json().catch(() => ({}))) as {
    punchId?: number;
    studentId?: number | null;
    staffId?: number | null;
  };
  const punchId = Number(body.punchId ?? 0);
  if (!punchId || !(body.studentId || body.staffId)) {
    return NextResponse.json({ error: "punchId and studentId/staffId required" }, { status: 400 });
  }

  // scope check for the chosen person
  if (body.studentId) {
    const s = await prisma.student.findFirst({
      where: { id: Number(body.studentId), institutionId: session.institutionId },
      select: { id: true },
    });
    if (!s) return NextResponse.json({ error: "Invalid student" }, { status: 400 });
  }
  if (body.staffId) {
    const s = await prisma.staff.findFirst({
      where: { id: Number(body.staffId), institutionId: session.institutionId },
      select: { id: true },
    });
    if (!s) return NextResponse.json({ error: "Invalid staff" }, { status: 400 });
  }

  const result = await mapPunchToPerson({
    institutionId: session.institutionId,
    punchId,
    studentId: body.studentId ? Number(body.studentId) : null,
    staffId: body.staffId ? Number(body.staffId) : null,
  });
  if (!result.ok) return NextResponse.json({ error: result.error }, { status: 404 });
  return NextResponse.json(result);
}