afrov2/app/api/businesses/[id]/route.ts

import { NextRequest, NextResponse } from 'next/server'
import prisma from '@/lib/prisma'
import { USER_SAFE_SELECT, getAuthUser } from '@/lib/auth-utils'

// GET /api/businesses/[id]
export async function GET(
  request: NextRequest, 
  context: { params: Promise<{ id: string }> }
): Promise<Response> {
    try {
        const user = await getAuthUser(request)
        if (!user) {
            return NextResponse.json({ error: 'Authentification requise' }, { status: 401 })
        }

        const { id } = await context.params
        const business = await prisma.business.findFirst({
            where: {
                OR: [
                    { id: id },
                    { slug: id }
                ]
            },
            include: { 
                owner: {
                    select: USER_SAFE_SELECT
                }, 
                offers: true 
            },
        })
        if (!business) return NextResponse.json({ error: 'Non trouvé' }, { status: 404 })
        
        // Mask technical IDs
        const { id: bizId, ownerId, ...rest } = business
        return NextResponse.json({ 
            ...rest, 
            id: business.slug || bizId 
        })
    } catch (error) {
        console.error('GET /api/businesses/[id] error:', error)
        return NextResponse.json({ error: 'Erreur serveur' }, { status: 500 })
    }
}

// PATCH /api/businesses/[id]
export async function PATCH(
  request: NextRequest, 
  context: { params: Promise<{ id: string }> }
): Promise<Response> {
    try {
        const authUser = await getAuthUser(request)
        if (!authUser) {
            return NextResponse.json({ error: 'Authentification requise' }, { status: 401 })
        }

        const { id } = await context.params
        const existing = await prisma.business.findUnique({
            where: { id },
            select: { ownerId: true }
        })

        if (!existing) {
            return NextResponse.json({ error: 'Boutique non trouvée' }, { status: 404 })
        }

        const isAdmin = authUser.role === 'ADMIN'
        const isOwner = existing.ownerId === authUser.id

        if (!isOwner && !isAdmin) {
            return NextResponse.json({ error: 'Non autorisé' }, { status: 403 })
        }

        const body = await request.json()

        // Whitelist allowed fields for owners; sensitive fields require ADMIN role
        const allowedOwnerFields = [
            'name', 'slug', 'category', 'categoryId', 'suggestedCategory',
            'location', 'countryId', 'city', 'description', 'logoUrl',
            'coverUrl', 'coverPosition', 'coverZoom', 'videoUrl',
            'contactEmail', 'contactPhone', 'websiteUrl', 'socialLinks',
            'showEmail', 'showPhone', 'showSocials', 'tags',
            'founderName', 'founderImageUrl', 'keyMetric', 'isActive'
        ]
        const allowedAdminFields = [
            ...allowedOwnerFields,
            'verified', 'plan', 'isFeatured', 'isHomeFeatured',
            'isSuspended', 'suspensionReason', 'metaTitle', 'metaDescription'
        ]

        const permittedKeys = isAdmin ? allowedAdminFields : allowedOwnerFields
        const updateData: Record<string, any> = {}
        for (const key of permittedKeys) {
            if (body[key] !== undefined) {
                updateData[key] = body[key]
            }
        }

        const business = await prisma.business.update({
            where: { id },
            data: updateData,
            include: { 
                owner: {
                    select: USER_SAFE_SELECT
                }, 
                offers: true 
            },
        })
        return NextResponse.json(business)
    } catch (error) {
        console.error('PATCH /api/businesses/[id] error:', error)
        return NextResponse.json({ error: 'Erreur lors de la mise à jour' }, { status: 500 })
    }
}

// DELETE /api/businesses/[id]
export async function DELETE(
  request: NextRequest, 
  context: { params: Promise<{ id: string }> }
): Promise<Response> {
    try {
        const authUser = await getAuthUser(request)
        if (!authUser) {
            return NextResponse.json({ error: 'Authentification requise' }, { status: 401 })
        }

        const { id } = await context.params

        // 1. Find business to check owner
        const business = await prisma.business.findUnique({
            where: { id },
            select: { ownerId: true }
        })

        if (!business) {
            return NextResponse.json({ error: 'Boutique non trouvée' }, { status: 404 })
        }

        // 2. Auth check (Owner or Admin)
        const isAdmin = authUser.role === 'ADMIN'
        const isOwner = business.ownerId === authUser.id

        if (!isOwner && !isAdmin) {
            return NextResponse.json({ error: 'Non autorisé' }, { status: 403 })
        }

        // 3. Delete business
        await prisma.business.delete({ where: { id } })

        // 4. Update user role if they don't have other businesses
        if (!isAdmin) {
            const otherBusinesses = await prisma.business.findFirst({
                where: { ownerId: authUser.id }
            })
            if (!otherBusinesses) {
                await prisma.user.update({
                    where: { id: authUser.id },
                    data: { role: 'VISITOR' }
                })
            }
        }

        return NextResponse.json({ success: true })
    } catch (error) {
        console.error('DELETE /api/businesses/[id] error:', error)
        return NextResponse.json({ error: 'Erreur lors de la suppression' }, { status: 500 })
    }
}