import { NextResponse } from "next/server";
import { prisma } from "@/lib/prisma";
import { requireAnyRole } from "@/lib/auth";
import { getUploadPolicy, maxDataUrlLength } from "@/lib/upload-policy";

type Params = { params: Promise<{ id: string }> };

const KINDS = ["STUDENT_ID", "FATHER_NID", "MOTHER_NID"];
const SIDES = ["FRONT", "BACK"];

/** Resolve access: admin/teacher scope by institution, member roles own (child's) profile. */
async function authorize(sessionId: { role: string; userId: number; institutionId: number | null }, studentId: number) {
  if (sessionId.role === "INSTITUTION_ADMIN" || sessionId.role === "TEACHER") {
    if (!sessionId.institutionId) return false;
    const student = await prisma.student.findFirst({
      where: { id: studentId, institutionId: sessionId.institutionId },
      select: { id: true },
    });
    return !!student;
  }
  const me = await prisma.user.findUnique({ where: { id: sessionId.userId } });
  const ownId = sessionId.role === "STUDENT" ? me?.studentProfileId : me?.parentOfStudentId;
  return ownId === studentId;
}

/** Media panel: all uploaded document scans for a student. */
export async function GET(_req: Request, { params }: Params) {
  const session = await requireAnyRole(["INSTITUTION_ADMIN", "TEACHER", "STUDENT", "PARENT"]);
  if (!session) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });

  const { id } = await params;
  const studentId = Number(id);
  if (!(await authorize(session, studentId))) {
    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
  }

  const media = await prisma.studentMedia.findMany({
    where: { studentId },
    select: { id: true, kind: true, side: true, dataUrl: true, uploadedAt: true },
    orderBy: [{ kind: "asc" }, { side: "asc" }],
  });
  return NextResponse.json({ media });
}

/** Upload/replace one scan: { kind, side, dataUrl }. */
export async function PUT(req: Request, { params }: Params) {
  const session = await requireAnyRole(["INSTITUTION_ADMIN", "TEACHER", "STUDENT", "PARENT"]);
  if (!session) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });

  const { id } = await params;
  const studentId = Number(id);
  if (!(await authorize(session, studentId))) {
    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
  }

  try {
    const body = await req.json();
    const kind = String(body.kind ?? "");
    const side = String(body.side ?? "");
    const dataUrl = String(body.dataUrl ?? "");
    if (!KINDS.includes(kind) || !SIDES.includes(side)) {
      return NextResponse.json({ error: "Invalid slot" }, { status: 400 });
    }
    const policy = await getUploadPolicy();
    if (!dataUrl.startsWith("data:image/") || dataUrl.length > maxDataUrlLength(policy.imageMaxKb)) {
      return NextResponse.json({ error: "IMAGE_TOO_LARGE" }, { status: 400 });
    }

    const media = await prisma.studentMedia.upsert({
      where: { studentId_kind_side: { studentId, kind, side } },
      update: { dataUrl },
      create: { studentId, kind, side, dataUrl },
      select: { id: true, kind: true, side: true },
    });
    return NextResponse.json({ media });
  } catch {
    return NextResponse.json({ error: "Could not save media" }, { status: 500 });
  }
}

/** Remove one scan: ?mediaId= */
export async function DELETE(req: Request, { params }: Params) {
  const session = await requireAnyRole(["INSTITUTION_ADMIN", "TEACHER"]);
  if (!session) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });

  const { id } = await params;
  const studentId = Number(id);
  if (!(await authorize(session, studentId))) {
    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
  }

  const mediaId = Number(new URL(req.url).searchParams.get("mediaId"));
  if (!mediaId) return NextResponse.json({ error: "Missing media" }, { status: 400 });

  await prisma.studentMedia.deleteMany({ where: { id: mediaId, studentId } });
  return NextResponse.json({ ok: true });
}