import { NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { db, reports, comments, recipes, users, eq } from "@epicure/db";
import { requireSession } from "@/lib/api-auth";
import { applyRateLimit } from "@/lib/rate-limit";
import { randomUUID } from "crypto";

const Schema = z.object({
  targetType: z.enum(["recipe", "comment", "user"]),
  targetId: z.string().min(1),
  reason: z.string().min(1).max(1000),
});

export async function POST(req: NextRequest) {
  const { session, response } = await requireSession();
  if (response) return response;

  const limited = await applyRateLimit(`rl:report:${session!.user.id}`, 10, 60);
  if (limited) return limited;

  const body = await req.json() as unknown;
  const parsed = Schema.safeParse(body);
  if (!parsed.success) return NextResponse.json({ error: "Validation error" }, { status: 400 });

  const { targetType, targetId, reason } = parsed.data;

  const exists =
    targetType === "recipe"
      ? await db.query.recipes.findFirst({ where: eq(recipes.id, targetId) })
      : targetType === "comment"
        ? await db.query.comments.findFirst({ where: eq(comments.id, targetId) })
        : await db.query.users.findFirst({ where: eq(users.id, targetId) });

  if (!exists) return NextResponse.json({ error: "Target not found" }, { status: 404 });

  await db.insert(reports).values({
    id: randomUUID(),
    reporterId: session!.user.id,
    targetType,
    targetId,
    reason,
  });

  return NextResponse.json({ ok: true }, { status: 201 });
}