import { connectDB } from "@/lib/db";
import { getSettings } from "@/models/settings.model";
import { posVendorProductsEnabled } from "@/lib/pos/build-pos-settings";
import { successResponse } from "@/lib/api/response";
import { AuthorizationError } from "@/lib/api/errors";
import { canAccessPOS } from "@/lib/rbac";
import { withApi } from "@/lib/api/handler";
import {
  listPOSProducts,
  POS_PRODUCT_PAGE_SIZE,
} from "@/lib/pos/list-products";
import type { POSStockStatusFilter } from "@/lib/pos/product-stock";

/**
 * GET /api/pos/products
 * Search products available for POS
 */
export const GET = withApi({ auth: "user" }, async ({ request, session }) => {
  if (!(await canAccessPOS(session.user))) throw new AuthorizationError();

  await connectDB();
  const settings = await getSettings();

  const { searchParams } = new URL(request.url);
  const stockStatusParam = searchParams.get("stockStatus") || "all";
  const stockStatus: POSStockStatusFilter =
    stockStatusParam === "in_stock" || stockStatusParam === "out_of_stock"
      ? stockStatusParam
      : "all";

  // `?ids=a,b,c` re-reads a known basket (resuming a held sale) rather than
  // browsing. Capped so a crafted URL cannot turn it into a bulk export.
  const idsParam = searchParams.get("ids");
  const ids = idsParam
    ? idsParam
        .split(",")
        .map((id) => id.trim())
        .filter(Boolean)
        .slice(0, POS_PRODUCT_PAGE_SIZE)
    : undefined;

  const data = await listPOSProducts(session.user, {
    ids,
    search: searchParams.get("search") || "",
    categoryId: searchParams.get("category") || "",
    locationId: searchParams.get("locationId") || "",
    stockStatus,
    vendorId: searchParams.get("vendorId") || "",
    source: searchParams.get("source") || "all",
    limit: Number(searchParams.get("limit")) || POS_PRODUCT_PAGE_SIZE,
    allowVendorProducts: posVendorProductsEnabled(settings),
  });

  return successResponse(data);
});