export const dynamic = 'force-dynamic';
export const revalidate = 0;

import { NextResponse } from 'next/server';
import { getSql } from '../../lib/db.js';
import { getOrgId } from '../../lib/org.js';
import { apiErrorResponse } from '../../lib/apiErrors.js';
import {
  listCapabilities,
  createCapability,
} from '../../lib/repositories/capabilities.repository.js';

export async function GET(request) {
  try {
    const sql = getSql();
    const orgId = getOrgId(request);
    const { searchParams } = new URL(request.url);

    const category = searchParams.get('category') || undefined;
    const risk_level = searchParams.get('risk_level') || undefined;
    const search = searchParams.get('search') || undefined;
    const limit = searchParams.get('limit') || 100;
    const offset = searchParams.get('offset') || 0;

    const capabilities = await listCapabilities(sql, orgId, {
      category,
      risk_level,
      search,
      limit,
      offset,
    });
    return NextResponse.json({ capabilities });
  } catch (error) {
    return apiErrorResponse(error, 'CAPABILITIES GET');
  }
}

export async function POST(request) {
  try {
    const sql = getSql();
    const orgId = getOrgId(request);
    const body = await request.json();

    if (!body?.name) {
      return NextResponse.json({ error: 'name is required' }, { status: 400 });
    }

    try {
      const capability = await createCapability(sql, orgId, body);
      return NextResponse.json({ capability }, { status: 201 });
    } catch (validationError) {
      if (
        validationError.message?.startsWith('risk_level') ||
        validationError.message?.startsWith('source_type')
      ) {
        return NextResponse.json({ error: validationError.message }, { status: 400 });
      }
      throw validationError;
    }
  } catch (error) {
    if (error.message?.includes('unique') || error.message?.includes('duplicate')) {
      return NextResponse.json(
        { error: 'A capability with this slug already exists' },
        { status: 409 }
      );
    }
    return apiErrorResponse(error, 'CAPABILITIES POST');
  }
}
