import { NextResponse } from "next/server";
import { prisma } from "@/lib/prisma";
import { requireRole } from "@/lib/auth";
import { sanitizeCollectionAccount } from "@/lib/collection-account";

export async function PUT(req: Request, ctx: { params: Promise<{ id: string }> }) {
  const session = await requireRole("INSTITUTION_ADMIN");
  if (!session?.institutionId) {
    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
  }
  const { id } = await ctx.params;
  const existing = await prisma.collectionAccount.findFirst({
    where: { id: Number(id), institutionId: session.institutionId },
  });
  if (!existing) return NextResponse.json({ error: "Not found" }, { status: 404 });

  const body = (await req.json().catch(() => ({}))) as Record<string, unknown>;
  const parsed = sanitizeCollectionAccount(body);
  if ("error" in parsed) return NextResponse.json({ error: parsed.error }, { status: 400 });
  const account = await prisma.collectionAccount.update({ where: { id: existing.id }, data: parsed.data });
  return NextResponse.json({ account });
}

export async function DELETE(_req: Request, ctx: { params: Promise<{ id: string }> }) {
  const session = await requireRole("INSTITUTION_ADMIN");
  if (!session?.institutionId) {
    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
  }
  const { id } = await ctx.params;
  const existing = await prisma.collectionAccount.findFirst({
    where: { id: Number(id), institutionId: session.institutionId },
  });
  if (!existing) return NextResponse.json({ error: "Not found" }, { status: 404 });
  await prisma.collectionAccount.delete({ where: { id: existing.id } });
  return NextResponse.json({ ok: true });
}