import { eq } from "drizzle-orm";
import * as z from "zod";
import { getDb } from "@/db";
import { commissionTickets } from "@/db/schema";
import { requireAdmin } from "@/lib/auth/server";
import { notifyCommission } from "@/lib/commission/server";
import { errorResponse, HttpError, readJson, requireSameOrigin } from "@/lib/security/http";

export async function PATCH(request: Request, context: RouteContext<"/api/commission/tickets/[id]/status">) {
  try {
    requireSameOrigin(request);
    await requireAdmin();
    const { id } = await context.params;
    const parsed = z.object({ status: z.enum(["open", "closed"]) }).safeParse(await readJson(request));
    if (!parsed.success) throw new HttpError(400, "invalid-status");
    const [ticket] = await getDb().update(commissionTickets)
      .set({ status: parsed.data.status, updatedAt: new Date() })
      .where(eq(commissionTickets.id, id)).returning({ userId: commissionTickets.userId });
    if (!ticket) throw new HttpError(404, "ticket-not-found");
    await notifyCommission(id, ticket.userId);
    return Response.json({ status: parsed.data.status });
  } catch (cause) { return errorResponse(cause); }
}