import { NextRequest } from "next/server";
import { Role } from "@prisma/client";
import { z } from "zod";
import { fail, ok, parseJson } from "@/server/http";
import { requireUser } from "@/server/security/auth";
import { requireRole } from "@/server/security/rbac";
import { reviewCryptoWithdrawal } from "@/server/crypto/payments";

export const dynamic = "force-dynamic";

const reviewSchema = z.object({
  action: z.enum(["approve", "reject", "mark_broadcasted"]),
  reason: z.string().max(500).optional(),
  txHash: z.string().max(160).optional()
});

export async function PATCH(request: NextRequest, context: { params: Promise<{ id: string }> }) {
  try {
    const auth = await requireUser(request);
    requireRole(auth.roles, [Role.ADMIN, Role.SUPER_ADMIN, Role.FINANCE_MANAGER]);
    const params = await context.params;
    const input = await parseJson(request, reviewSchema);
    const withdrawal = await reviewCryptoWithdrawal({
      withdrawalId: params.id,
      actorUserId: auth.user.id,
      action: input.action,
      reason: input.reason,
      txHash: input.txHash
    });

    return ok({
      withdrawal: {
        id: withdrawal.id,
        status: withdrawal.status,
        txHash: withdrawal.txHash,
        reviewReason: withdrawal.reviewReason,
        reviewedAt: withdrawal.reviewedAt
      }
    });
  } catch (error) {
    return fail(error);
  }
}