import { NextRequest, NextResponse } from 'next/server'
import { connectToDatabase } from '@/lib/mongodb'
import { ObjectId } from 'bson'
import { authOptions } from '@/lib/auth'
import { getServerSession } from 'next-auth'

export async function GET() {
  try {
    const { db } = await connectToDatabase()
    const notice = await db.collection('notices').findOne(
      {}, 
      { sort: { createdAt: -1 } }
    )
    
    if (!notice) {
      return NextResponse.json({ notice: null })
    }
    
    return NextResponse.json({ notice })
  } catch (error) {
    console.error('Error fetching notice:', error)
    return NextResponse.json({ error: 'Failed to fetch notice' }, { status: 500 })
  }
}

export async function POST(request: NextRequest) {
  //! this is probablyt vulnerable but whooo cares
  try {
    const { db } = await connectToDatabase();
    const { message, reason } = await request.json();
    const session = await getServerSession(authOptions);

    // check if admin
    if (!session) {
      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
    }

    const user = await db.collection('users').findOne({ _id: new ObjectId(session?.user.id) })
    if (!user) {
        return NextResponse.json({ error: 'User not found' }, { status: 404 })
    }
    if (!user.isAdmin) {
        return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
    }
    
    const notice = {
      message,
      reason,
      createdAt: new Date(),
      updatedAt: new Date()
    };
    
    await db.collection('notices').insertOne(notice);
    
    return NextResponse.json({ success: true, notice });
  } catch (error) {
    console.error('Error setting notice:', error);
    return NextResponse.json({ error: 'Failed to set notice' }, { status: 500 });
  }
}