import { getDb } from "@/db";
import { commissionCheckouts, commissionSettings } from "@/db/schema";
import { eq } from "drizzle-orm";
import { validateCommissionCatalog } from "@/lib/commission/catalog";
import { promptPayConfig } from "@/lib/commission/payment";
import { commissionPrice, commissionRequestSchema } from "@/lib/commission/request";
import { requireCommissionUser } from "@/lib/commission/server";
import { errorResponse, HttpError, readJson, requireSameOrigin } from "@/lib/security/http";
import { limitRequest } from "@/lib/security/rate-limit";

export async function POST(request: Request) {
  try {
    requireSameOrigin(request);
    const user = await requireCommissionUser();
    await limitRequest("commission-checkout", user.id, 15);
    const parsed = commissionRequestSchema.safeParse(await readJson(request, 32 * 1024));
    if (!parsed.success || !(await validateCommissionCatalog(parsed.data)))
      throw new HttpError(400, "invalid-commission-request");
    promptPayConfig();
    const checkout = await getDb().transaction(async (tx) => {
      const [settings] = await tx.select({ isOpen: commissionSettings.isOpen }).from(commissionSettings)
        .where(eq(commissionSettings.id, 1)).for("update");
      if (!settings) throw new Error("Commission settings are missing. Apply the database migration.");
      if (!settings.isOpen) throw new HttpError(409, "commission-closed");
      const [created] = await tx.insert(commissionCheckouts).values({
        userId: user.id, request: parsed.data, amountBaht: commissionPrice(parsed.data),
      }).returning({ id: commissionCheckouts.id });
      return created;
    });
    return Response.json({ checkoutId: checkout.id }, { status: 201, headers: { "Cache-Control": "no-store" } });
  } catch (cause) { return errorResponse(cause); }
}