import { boundedFormData } from "../../../../../../server/security.ts";
import { getAdmin } from "../../../../../../lib/admin-auth";
import {
  audit,
  publicUrl,
  sameOrigin,
} from "../../../../../../lib/admin-operations";
import { env } from "../../../../../../lib/server-env";
const allowed = new Set(["RECEIVED", "ACCEPTED", "REJECTED"]);
export async function POST(
  request: Request,
  { params }: { params: Promise<{ id: string }> },
) {
  const admin = await getAdmin();
  if (!admin) return Response.json({ error: "unauthorized" }, { status: 401 });
  if (!sameOrigin(request))
    return Response.json({ error: "invalid_origin" }, { status: 403 });
  const { id } = await params,
    form = await boundedFormData(request),
    status = String(form.get("status") || "");
  if (!allowed.has(status))
    return Response.json({ error: "invalid" }, { status: 400 });
  const doc = await env.DB.prepare(
    "SELECT application_id FROM documents WHERE id=?",
  )
    .bind(id)
    .first<{ application_id: string }>();
  if (!doc) return Response.json({ error: "not_found" }, { status: 404 });
  await env.DB.prepare(
    "UPDATE documents SET review_status=?,updated_at=? WHERE id=?",
  )
    .bind(status, new Date().toISOString(), id)
    .run();
  await audit(admin.userId, "DOCUMENT_REVIEWED", "DOCUMENT", id, {
    status,
    applicationId: doc.application_id,
  });
  return Response.redirect(
    publicUrl(request, `/administracao/candidaturas/${doc.application_id}`),
    303,
  );
}