import { boundedFormData } from "../../../../../../server/security.ts";
import { env } from "../../../../../../lib/server-env";
import { getAdmin } from "../../../../../../lib/admin-auth";
import { publicUrl, sameOrigin } from "../../../../../../lib/admin-operations";
const allowed = new Set([
  "SUBMITTED",
  "UNDER_REVIEW",
  "INCOMPLETE",
  "ADMITTED",
  "WAITLIST",
  "REJECTED",
]);
export async function POST(
  request: Request,
  { params }: { params: Promise<{ id: string }> },
) {
  const admin = await getAdmin();
  if (!admin) return Response.json({ error: "unauthorized" }, { status: 401 });
  if (!sameOrigin(request))
    return Response.json({ error: "invalid_origin" }, { status: 403 });
  const { id } = await params;
  const form = await boundedFormData(request);
  const status = String(form.get("status") || "");
  const reason = String(form.get("reason") || "")
    .trim()
    .slice(0, 1000);
  if (!allowed.has(status) || !reason)
    return Response.json({ error: "invalid" }, { status: 400 });
  const current = await env.DB.prepare(
    "SELECT status FROM applications WHERE id=?",
  )
    .bind(id)
    .first<{ status: string }>();
  if (!current) return Response.json({ error: "not_found" }, { status: 404 });
  const now = new Date().toISOString();
  await env.DB.batch([
    env.DB.prepare(
      "UPDATE applications SET status=?,updated_at=? WHERE id=?",
    ).bind(status, now, id),
    env.DB.prepare(
      "INSERT INTO application_status_history (id,application_id,actor_user_id,from_status,to_status,reason,created_at) VALUES (?,?,?,?,?,?,?)",
    ).bind(
      crypto.randomUUID(),
      id,
      admin.userId,
      current.status,
      status,
      reason,
      now,
    ),
    env.DB.prepare(
      "INSERT INTO audit_logs (id,actor_user_id,action,resource_type,resource_id,metadata,created_at) VALUES (?,?, 'APPLICATION_STATUS_CHANGED','APPLICATION',?,?,?)",
    ).bind(
      crypto.randomUUID(),
      admin.userId,
      id,
      JSON.stringify({ from: current.status, to: status }),
      now,
    ),
  ]);
  return Response.redirect(
    publicUrl(request, `/administracao/candidaturas/${id}`),
    303,
  );
}