import { NextResponse } from "next/server";
import { headers } from "next/headers";
import { auth } from "@/lib/auth/server";
import { db, users, eq } from "@epicure/db";
import { z } from "zod";

const PatchSchema = z.object({
  name: z.string().min(1).max(100).optional(),
  locale: z.string().max(10).optional(),
  bio: z.string().max(500).optional().nullable(),
  privateBio: z.string().max(2000).optional().nullable(),
  isPrivate: z.boolean().optional(),
});

export async function PATCH(req: Request) {
  const session = await auth.api.getSession({ headers: await headers() });
  if (!session) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });

  const body = PatchSchema.safeParse(await req.json());
  if (!body.success) return NextResponse.json({ error: body.error.flatten() }, { status: 400 });

  await db.update(users).set(body.data).where(eq(users.id, session.user.id));
  return NextResponse.json({ ok: true });
}