// app/api/notifications/route.ts
import { NextResponse } from "next/server"
import { auth } from "@/lib/auth"
import { db } from "@/lib/db"
import { hasPermission } from "@/lib/permissions"
import { createNotification, getNotificationsForUser } from "@/features/notifications/service"

export async function GET() {
  const session = await auth()
  if (!session?.user?.id) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })

  const notifications = await getNotificationsForUser(session.user.id)
  return NextResponse.json(notifications)
}

export async function POST(req: Request) {
  const session = await auth()
  console.log("session.user:", session?.user)
  if (!session?.user?.id) return NextResponse.json({ error: "Unauthorized" }, { status: 401 })

  const userRoles = await db.userRole.findMany({
    where: { userId: session.user.id },
    select: { roleId: true },
  })
  const roleIds = userRoles.map((r) => r.roleId)

  const allowed = await hasPermission(roleIds, "notifications", "create")
  if (!allowed) return NextResponse.json({ error: "Forbidden" }, { status: 403 })

  const body = await req.json()
  const notification = await createNotification(session.user.id, body)
  return NextResponse.json(notification, { status: 201 })
}