import { randomUUID } from "node:crypto";
import { getAdmin } from "../../../../../../lib/admin-auth";
import { publicUrl, cleanText } from "../../../../../../lib/admin-operations";
import { boundedFormData } from "../../../../../../server/security.ts";
import { DB } from "../../../../../../server/database.ts";
export async function POST(
  request: Request,
  { params }: { params: Promise<{ id: string }> },
) {
  const admin = await getAdmin();
  if (!admin) return Response.json({ error: "unauthorized" }, { status: 401 });
  const { id } = await params,
    form = await boundedFormData(request),
    message = cleanText(form.get("message"));
  if (!message) return Response.json({ error: "invalid" }, { status: 400 });
  const row = await DB.prepare(
    "SELECT a.status,g.email FROM applications a JOIN guardians g ON g.application_id=a.id AND g.is_education_guardian=1 WHERE a.id=? AND a.deleted_at IS NULL",
  )
    .bind(id)
    .first<{ status: string; email: string }>();
  if (!row) return Response.json({ error: "not_found" }, { status: 404 });
  const now = new Date().toISOString(),
    rid = randomUUID(),
    cid = randomUUID();
  await DB.batch([
    DB.prepare(
      "INSERT INTO document_requests VALUES (?,?,?,?,?,'PENDING',NULL,?)",
    ).bind(rid, id, admin.userId, row.email, message, now),
    DB.prepare(
      "INSERT INTO communications(id,application_id,recipient,template_key,status,attempts,message_body,document_request_id,created_at,updated_at) VALUES (?,?,?,'DOCUMENT_REQUEST','PENDING',0,?,?,?,?)",
    ).bind(cid, id, row.email, message, rid, now, now),
    DB.prepare(
      "INSERT INTO outbox_jobs(id,kind,resource_id,status,attempts,available_at,created_at,updated_at) VALUES (?,'SEND_APPLICATION_EMAIL',?,'PENDING',0,?,?,?)",
    ).bind(randomUUID(), cid, now, now, now),
    DB.prepare(
      "UPDATE applications SET status='INCOMPLETE',updated_at=? WHERE id=?",
    ).bind(now, id),
    DB.prepare(
      "INSERT INTO application_status_history VALUES (?,?,?,?,?,'Pedido de documentos',?)",
    ).bind(randomUUID(), id, admin.userId, row.status, "INCOMPLETE", now),
    DB.prepare(
      "INSERT INTO audit_logs VALUES (?,?,'DOCUMENTS_REQUESTED','APPLICATION',?,NULL,?)",
    ).bind(randomUUID(), admin.userId, id, now),
  ]);
  return Response.redirect(
    publicUrl(request, `/administracao/candidaturas/${id}?documents=queued`),
    303,
  );
}