integratedhub/routes/api/retrieve/tenant_applications.ts

// routes/api/retrieve/tenant_applications.ts
import { define } from "../../../utils.ts";
import {
  getApplicationById,
  getApplicationsByApplicant,
  getApplicationsByProperty,
  getApplicationStats,
  getTenantApplicationsByUser,
} from "../../../services/tenantApplicationService.ts";
import { SessionCookie } from "../../auth/callback.ts";

export const handler = define.handlers({
  async GET(ctx) {
    try {
      const stateData: SessionCookie = ctx.state.data;
      const { user_id, user_type } = stateData;

      const url = new URL(ctx.req.url);
      const property_id = url.searchParams.get("property_id");
      const applicant_id = url.searchParams.get("applicant_id");
      const application_id = url.searchParams.get("id");
      const stats_only = url.searchParams.get("stats_only") === "true";

      let result;

      if (application_id) {
        // Get specific application
        result = await getApplicationById(application_id);

        // DATA ISOLATION: Verify user has access to this application
        if (result) {
          if (user_type === "tenant" && result.applicant_id !== user_id) {
            return new Response(
              JSON.stringify({
                error: "Application not found or unauthorized",
              }),
              {
                status: 403,
                headers: { "Content-Type": "application/json" },
              },
            );
          }
          // Landlords need to verify property ownership (would require property lookup)
          // For now, we'll allow landlords to see any application and filter on the UI side
        }

        return new Response(
          JSON.stringify({
            success: true,
            application: result,
          }),
          {
            status: 200,
            headers: { "Content-Type": "application/json" },
          },
        );
      } else if (property_id) {
        // DATA ISOLATION: Only landlords can query applications by property
        // Tenants should use the default endpoint to get their own applications
        if (user_type !== "landlord" && user_type !== "admin") {
          return new Response(
            JSON.stringify({
              error: "Unauthorized to view applications for this property",
            }),
            {
              status: 403,
              headers: { "Content-Type": "application/json" },
            },
          );
        }

        // Get applications for a property
        if (stats_only) {
          result = await getApplicationStats(property_id);
          return new Response(
            JSON.stringify({
              success: true,
              stats: result,
            }),
            {
              status: 200,
              headers: { "Content-Type": "application/json" },
            },
          );
        } else {
          result = await getApplicationsByProperty(property_id);
        }
      } else if (applicant_id) {
        // DATA ISOLATION: Users can only query their own applications
        if (applicant_id !== user_id && user_type !== "admin") {
          return new Response(
            JSON.stringify({
              error: "Unauthorized to view applications for this user",
            }),
            {
              status: 403,
              headers: { "Content-Type": "application/json" },
            },
          );
        }
        // Get applications by applicant
        result = await getApplicationsByApplicant(applicant_id);
      } else {
        // Get applications based on user role (tenant = own applications, landlord = applications for their properties)
        result = await getTenantApplicationsByUser(user_id, user_type);
      }

      return new Response(
        JSON.stringify({
          success: true,
          applications: result,
        }),
        {
          status: 200,
          headers: { "Content-Type": "application/json" },
        },
      );
    } catch (e) {
      return new Response(JSON.stringify({ error: e }), {
        status: 500,
        headers: { "Content-Type": "application/json" },
      });
    }
  },
});