import { NextRequest, NextResponse } from "next/server";
import { withPermission } from "@/lib/middleware/authorize";
import { withTenantContext } from "@/lib/prisma-tenant";

/**
 * GET /api/accounting/periods
 *
 * Lists all accounting periods for the authenticated tenant.
 * Ordered by year descending, then month descending (most recent first).
 *
 * Requires: ADMIN role (read on Account subject).
 *
 * Response:
 *   200 OK — Array of { id, year, month, status, closedAt, closedById, createdAt }
 *   401 Unauthorized — no session
 *   403 Forbidden — insufficient role
 */
export const GET = withPermission("read", "Account")(
  async (_req: NextRequest, { user }) => {
    if (!user.tenantId) {
      return NextResponse.json(
        { error: "No tenant context — super-admins must use the admin API" },
        { status: 400 }
      );
    }

    const tenantPrisma = withTenantContext(user.tenantId);

    const periods = await tenantPrisma.accountingPeriod.findMany({
      orderBy: [{ year: "desc" }, { month: "desc" }],
      select: {
        id: true,
        year: true,
        month: true,
        status: true,
        closedAt: true,
        closedById: true,
        createdAt: true,
      },
    });

    return NextResponse.json(periods);
  }
);