import { NextRequest } from "next/server";
import { KycStatus, Role } from "@prisma/client";
import { z } from "zod";
import { prisma } from "@/server/db";
import { writeAuditLog } from "@/server/audit";
import { fail, ok, parseJson } from "@/server/http";
import { requireUser } from "@/server/security/auth";
import { requireRole } from "@/server/security/rbac";

const schema = z.object({
  userId: z.string().uuid(),
  reason: z.string().trim().min(5).max(500).optional()
});

export const dynamic = "force-dynamic";

export async function POST(request: NextRequest) {
  try {
    const auth = await requireUser(request);
    requireRole(auth.roles, [Role.KYC_ANALYST, Role.ADMIN, Role.SUPER_ADMIN]);
    const input = await parseJson(request, schema);
    const reason = input.reason ?? "Vérification requise par le support.";

    const user = await prisma.user.findUniqueOrThrow({
      where: { id: input.userId },
      select: { id: true, email: true }
    });

    const existingPendingCase = await prisma.kycCase.findFirst({
      where: { userId: user.id, status: KycStatus.PENDING },
      orderBy: { openedAt: "desc" }
    });

    if (existingPendingCase) {
      return ok({
        case: {
          id: existingPendingCase.id,
          status: existingPendingCase.status,
          openedAt: existingPendingCase.openedAt
        }
      });
    }

    const kycCase = await prisma.kycCase.create({
      data: {
        userId: user.id,
        status: KycStatus.PENDING,
        provider: "manual_admin_request",
        providerRef: `admin-request-${user.id}-${Date.now()}`,
        decisions: {
          create: {
            adminUserId: auth.user.id,
            status: KycStatus.PENDING,
            reason
          }
        }
      }
    });

    await writeAuditLog({
      actorUserId: auth.user.id,
      action: "admin.kyc.request",
      entityType: "KycCase",
      entityId: kycCase.id,
      after: { userId: user.id, email: user.email, status: KycStatus.PENDING, reason }
    });

    return ok({
      case: {
        id: kycCase.id,
        status: kycCase.status,
        openedAt: kycCase.openedAt
      }
    });
  } catch (error) {
    return fail(error);
  }
}