import { errorResponse, requireSameOrigin, withUploadSlot } from "@/lib/security/http";
import { limitRequest } from "@/lib/security/rate-limit";
import * as z from "zod";

import { requireAdmin } from "@/lib/auth/server";
import { completePendingMedia } from "@/lib/media/repository";
import { auditActor } from "@/lib/audit-log";

export async function POST(
  request: Request,
  context: { params: Promise<{ id: string }> },
) {
  try {
    requireSameOrigin(request);
    const admin = await requireAdmin();
    await limitRequest("media", admin.user.id, 20);
    const { id } = await context.params;
    if (!z.string().uuid().safeParse(id).success) {
      return Response.json({ error: "invalid-id" }, { status: 400 });
    }
    const result = await withUploadSlot(() =>
      completePendingMedia(id, auditActor(admin.user)),
    );
    if (result.status === "ready") {
      return Response.json({
        media: {
          id: result.media.id,
          fileName: result.media.fileName,
          mimeType: result.media.mimeType,
          byteSize: result.media.byteSize,
          url: `/media/${result.media.id}`,
        },
      });
    }
    const status = result.status === "not-found" ? 404 : result.status === "missing" ? 409 : 422;
    return Response.json({ error: result.status }, { status });
  } catch (cause) {
    return errorResponse(cause);
  }
}