// routes/api/delete/tenant_application.ts
import { define } from "../../../utils.ts";
import {
  deleteApplication,
  getApplicationById,
  getApplicationsByApplicant as _getApplicationsByApplicant,
  getTenantApplicationsByLandlord,
} from "../../../services/tenantApplicationService.ts";
import { SessionCookie } from "../../auth/callback.ts";

export const handler = define.handlers({
  async POST(ctx) {
    try {
      const stateData: SessionCookie = ctx.state.data;
      const { user_id, user_type } = stateData;

      const contentType = ctx.req.headers.get("content-type") || "";
      let data: Record<string, string> = {};
      let sender: string | null = null;
      let isJsonRequest = false;

      // Handle both JSON and form data
      if (contentType.includes("application/json")) {
        isJsonRequest = true;
        const jsonData = await ctx.req.json();
        data = jsonData;
      } else {
        const formData = await ctx.req.formData();
        sender = formData.get("sender")?.toString() || null;

        data = {
          id: formData.get("id")?.toString() || "",
        };
      }

      const id = data.id;

      if (!id) {
        return new Response(
          JSON.stringify({
            error: "Application ID is required",
          }),
          {
            status: 400,
            headers: { "Content-Type": "application/json" },
          },
        );
      }

      // DATA ISOLATION: Verify user has authorization to delete this application
      const application = await getApplicationById(id);

      if (!application) {
        return new Response(
          JSON.stringify({
            error: "Application not found",
          }),
          {
            status: 404,
            headers: { "Content-Type": "application/json" },
          },
        );
      }

      let hasAccess = false;

      if (user_type === "tenant") {
        // Tenants can only delete their own applications
        if (application.applicant_id === user_id) {
          hasAccess = true;
        }
      } else if (user_type === "landlord" || user_type === "admin") {
        // Landlords can only delete applications for their properties
        const landlordApplications = await getTenantApplicationsByLandlord(
          user_id,
        );
        hasAccess = landlordApplications.some((app) => app.id === id);
      }

      if (!hasAccess) {
        return new Response(
          JSON.stringify({
            error: "Application not found or unauthorized",
          }),
          {
            status: 403,
            headers: { "Content-Type": "application/json" },
          },
        );
      }

      const result = await deleteApplication(id);

      // Return appropriate response based on request type
      if (isJsonRequest) {
        return new Response(
          JSON.stringify({
            success: true,
            deleted: result[0],
          }),
          {
            status: 200,
            headers: { "Content-Type": "application/json" },
          },
        );
      } else {
        // Redirect back to the sender URL
        const senderPath = sender?.toString() || "/";
        let redirectUrl = senderPath;
        try {
          if (senderPath.startsWith("/")) {
            const url = new URL(ctx.req.url);
            redirectUrl = url.origin + senderPath;
          }
        } catch (_) {
          // fallback: just use senderPath
        }
        return Response.redirect(redirectUrl, 303);
      }
    } catch (e) {
      return new Response(JSON.stringify({ error: e }), {
        status: 500,
        headers: { "Content-Type": "application/json" },
      });
    }
  },
});