// Next.js API route support: https://nextjs.org/docs/api-routes/introduction
import type {NextApiRequest, NextApiResponse} from "next";
import client from "@/lib/mongodb";
import {withIronSessionApiRoute} from "iron-session/next";
import {sessionOptions} from "@/lib/session";
import {Group} from "@/interfaces/user";
import {Package} from "@/interfaces/paypal";
import {v4} from "uuid";

const db = client.db(process.env.MONGODB_DB);

export default withIronSessionApiRoute(handler, sessionOptions);

async function handler(req: NextApiRequest, res: NextApiResponse) {
	if (req.method === "GET") await get(req, res);
	if (req.method === "POST") await post(req, res);
}

async function get(req: NextApiRequest, res: NextApiResponse) {
	const snapshot = await db.collection("packages").find({}).toArray();
	res.status(200).json(snapshot);
}

async function post(req: NextApiRequest, res: NextApiResponse) {
	if (!req.session.user) {
		res.status(401).json({ok: false});
		return;
	}
	
	if (!["developer", "admin"].includes(req.session.user!.type))
		return res.status(403).json({ok: false, reason: "You do not have permission to create a new package"});

	const body = req.body as Package;
	// Package already had an id but a new one was being set 
	// with v4() don't know if intentional or not, recreated the behaviour as was
	await db.collection("packages").insertOne({...body, id: v4()})
	res.status(200).json({ok: true});
}
