import { NextRequest, NextResponse } from 'next/server';
import { db, schema } from '@/lib/db';
import { getSession } from '@/lib/auth';
import { isCompanyOwner, getCompanyUsers } from '@/lib/companies';
import { eq } from 'drizzle-orm';

/**
 * DELETE /api/companies/[id]/conversions/[conversionId]
 * Permanently delete a conversion (company owner only).
 */
export async function DELETE(
  request: NextRequest,
  { params }: { params: Promise<{ id: string; conversionId: string }> }
) {
  try {
    const { id: companyId, conversionId } = await params;

    const accessToken = request.cookies.get('scriba.access_token')?.value;
    const sessionData = await getSession(accessToken);

    if (!sessionData) {
      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
    }

    const { user: currentUser } = sessionData;

    if (currentUser.companyId !== companyId) {
      return NextResponse.json(
        { error: 'Access denied. You are not a member of this company.' },
        { status: 403 }
      );
    }

    const isOwner = await isCompanyOwner(currentUser.id, companyId);
    if (!isOwner) {
      return NextResponse.json(
        { error: 'Only the company owner can delete conversions' },
        { status: 403 }
      );
    }

    const project = await db.query.projects.findFirst({
      where: eq(schema.projects.id, conversionId),
    });

    if (!project) {
      return NextResponse.json(
        { error: 'Conversion not found' },
        { status: 404 }
      );
    }

    const companyUsers = await getCompanyUsers(companyId);
    const companyUserIds = companyUsers.map(u => u.id);

    if (!project.userId || !companyUserIds.includes(project.userId)) {
      return NextResponse.json(
        { error: 'Conversion does not belong to this company' },
        { status: 403 }
      );
    }

    await db.delete(schema.projects).where(eq(schema.projects.id, conversionId));

    return NextResponse.json({
      success: true,
      message: 'Conversion deleted successfully. All data has been permanently removed.',
    });
  } catch (error) {
    console.error('Delete company conversion error:', error);
    return NextResponse.json(
      { error: 'Failed to delete conversion' },
      { status: 500 }
    );
  }
}