import { NextRequest, NextResponse } from "next/server";
import { withPermission } from "@/lib/middleware/authorize";
import { withTenantContext } from "@/lib/prisma-tenant";
import { getInvoice } from "@/lib/services/invoice-service";

/**
 * GET /api/invoices/[id]
 *
 * Get a single invoice by ID with line items.
 *
 * Requires: read on Invoice subject.
 *
 * Response:
 *   200 OK — Invoice with lines and subscriber details
 *   400 Bad Request — no tenant context
 *   404 Not Found — invoice not found
 *   401 Unauthorized — no session
 *   403 Forbidden — insufficient role
 */
export function GET(req: NextRequest, { params }: { params: Promise<{ id: string }> }) {
  return withPermission("read", "Invoice")(
    async (_req: NextRequest, { user }) => {
      if (!user.tenantId) {
        return NextResponse.json(
          { error: "No tenant context — super-admins must use the admin API" },
          { status: 400 }
        );
      }

      const { id } = await params;
      if (!id) {
        return NextResponse.json({ error: "Invoice ID is required" }, { status: 400 });
      }

      const tenantPrisma = withTenantContext(user.tenantId);
      const invoice = await getInvoice(tenantPrisma, id);

      if (!invoice) {
        return NextResponse.json({ error: "Invoice not found" }, { status: 404 });
      }

      return NextResponse.json(invoice);
    }
  )(req);
}