import { NextRequest } from "next/server";
import { KycStatus, Role } from "@prisma/client";
import { z } from "zod";
import { prisma } from "@/server/db";
import { writeAuditLog } from "@/server/audit";
import { fail, ok, parseJson } from "@/server/http";
import { requireUser } from "@/server/security/auth";
import { requireRole } from "@/server/security/rbac";

const schema = z.object({
  caseId: z.string().uuid(),
  status: z.enum([KycStatus.APPROVED, KycStatus.REJECTED, KycStatus.EXPIRED]),
  reason: z.string().min(5).max(500),
  expiresAt: z.coerce.date().optional()
});

export async function POST(request: NextRequest) {
  try {
    const auth = await requireUser(request);
    requireRole(auth.roles, [Role.KYC_ANALYST, Role.ADMIN]);
    const input = await parseJson(request, schema);
    const kycCase = await prisma.kycCase.update({
      where: { id: input.caseId },
      data: {
        status: input.status,
        decidedAt: new Date(),
        expiresAt: input.expiresAt,
        decisions: {
          create: {
            adminUserId: auth.user.id,
            status: input.status,
            reason: input.reason
          }
        }
      }
    });

    await writeAuditLog({
      actorUserId: auth.user.id,
      action: "admin.kyc.decision",
      entityType: "KycCase",
      entityId: kycCase.id,
      after: { status: input.status, reason: input.reason }
    });

    return ok({ case: kycCase });
  } catch (error) {
    return fail(error);
  }
}