import { randomUUID } from "node:crypto";
import { NextResponse } from "next/server";
import { getDbPool } from "@/db";
import { ensureCapitalTenant } from "@/lib/tenant";
import { getSession } from "@/lib/auth";
import { canOperateCapital } from "@/lib/authorization";

export const runtime = "nodejs";

export async function POST(request: Request, { params }: { params: Promise<{ externalId: string; photoId: string }> }) {
  try {
    const session = await getSession();
    if (!session) return NextResponse.json({ error: "Faça login para comentar." }, { status: 401 });
    if (!canOperateCapital(session)) return NextResponse.json({ error: "Comentários técnicos são exclusivos da operação Capital." }, { status: 403 });
    const { externalId, photoId } = await params;
    const { comment } = await request.json();
    const value = String(comment || "").trim();
    if (!value) return NextResponse.json({ error: "Digite um comentário para esta foto." }, { status: 400 });
    const tenantId = await ensureCapitalTenant();
    const db = getDbPool();
    const [photos] = await db.execute(
      `SELECT p.id FROM inspection_photos p INNER JOIN inspections i ON i.id = p.inspection_id
       WHERE p.id = ? AND i.external_id = ? AND i.tenant_id = ? LIMIT 1`,
      [photoId, externalId, tenantId],
    );
    if (!(photos as { id: string }[])[0]) return NextResponse.json({ error: "Foto não encontrada." }, { status: 404 });
    const name = session.name;
    await db.execute(
      `INSERT INTO inspection_photo_comments (id, inspection_photo_id, analyst_name, comment)
       VALUES (?, ?, ?, ?)
       ON DUPLICATE KEY UPDATE comment = VALUES(comment), updated_at = NOW()`,
      [randomUUID(), photoId, name, value],
    );
    return NextResponse.json({ analystName: name, message: "Comentário salvo." });
  } catch (error) {
    console.error("Erro ao salvar comentário da foto", error);
    return NextResponse.json({ error: "Não foi possível salvar o comentário." }, { status: 500 });
  }
}