import { boundedFormData } from "../../../../../../server/security.ts";
import { getAdmin } from "../../../../../../lib/admin-auth";
import {
  audit,
  cleanText,
  publicUrl,
  sameOrigin,
} from "../../../../../../lib/admin-operations";
import { env } from "../../../../../../lib/server-env";

export async function POST(
  request: Request,
  { params }: { params: Promise<{ id: string }> },
) {
  const admin = await getAdmin();
  if (!admin) return Response.json({ error: "unauthorized" }, { status: 401 });
  if (!sameOrigin(request))
    return Response.json({ error: "invalid_origin" }, { status: 403 });
  const { id } = await params,
    form = await boundedFormData(request),
    body = cleanText(form.get("body"));
  if (!body) return Response.json({ error: "invalid" }, { status: 400 });
  const exists = await env.DB.prepare(
    "SELECT 1 ok FROM applications WHERE id=?",
  )
    .bind(id)
    .first();
  if (!exists) return Response.json({ error: "not_found" }, { status: 404 });
  await env.DB.prepare(
    "INSERT INTO application_notes (id,application_id,author_user_id,body,created_at) VALUES (?,?,?,?,?)",
  )
    .bind(crypto.randomUUID(), id, admin.userId, body, new Date().toISOString())
    .run();
  await audit(admin.userId, "APPLICATION_NOTE_ADDED", "APPLICATION", id);
  return Response.redirect(
    publicUrl(request, `/administracao/candidaturas/${id}`),
    303,
  );
}