NetForge/src/app/api/technicians/route.ts

import { NextRequest, NextResponse } from "next/server";
import { withPermission } from "@/lib/middleware/authorize";
import { withTenantContext } from "@/lib/prisma-tenant";
import {
  listTechnicians,
  createTechnicianProfile,
} from "@/lib/services/technician-service";
import { CompensationModel } from "@prisma/client";

/**
 * GET /api/technicians
 *
 * List technician profiles for the current tenant.
 *
 * Query params: activeOnly? (boolean), zoneId? (string)
 *
 * Requires: read on TechnicianProfile subject (ADMIN, OFFICE_STAFF).
 *
 * Response:
 *   200 OK — { profiles, total }
 *   401 Unauthorized — no session
 *   403 Forbidden — insufficient role
 */
export function GET(req: NextRequest) {
  return withPermission("read", "TechnicianProfile")(
    async (req: NextRequest, { user }) => {
      if (!user.tenantId) {
        return NextResponse.json(
          { error: "No tenant context — super-admins must use the admin API" },
          { status: 400 }
        );
      }

      const url = new URL(req.url);
      const activeOnly = url.searchParams.get("activeOnly") === "true";
      const zoneId = url.searchParams.get("zoneId") ?? undefined;

      const tenantPrisma = withTenantContext(user.tenantId);
      const result = await listTechnicians(tenantPrisma, { activeOnly, zoneId });

      return NextResponse.json(result);
    }
  )(req);
}

/**
 * POST /api/technicians
 *
 * Create a new technician profile.
 *
 * Accepts: { userId, phone?, skills?, zoneId?, compensationModel?, monthlySalary? }
 *
 * Requires: create on TechnicianProfile subject (ADMIN only).
 *
 * Response:
 *   201 Created — created technician profile
 *   400 Bad Request — validation error
 *   401 Unauthorized — no session
 *   403 Forbidden — insufficient role
 */
export function POST(req: NextRequest) {
  return withPermission("create", "TechnicianProfile")(
    async (req: NextRequest, { user }) => {
      if (!user.tenantId) {
        return NextResponse.json(
          { error: "No tenant context — super-admins must use the admin API" },
          { status: 400 }
        );
      }

      let body: unknown;
      try {
        body = await req.json();
      } catch {
        return NextResponse.json({ error: "Invalid JSON body" }, { status: 400 });
      }

      const { userId, phone, skills, zoneId, compensationModel, monthlySalary } =
        body as Record<string, unknown>;

      if (!userId || typeof userId !== "string") {
        return NextResponse.json({ error: "userId is required" }, { status: 400 });
      }

      const tenantPrisma = withTenantContext(user.tenantId);

      try {
        const profile = await createTechnicianProfile(tenantPrisma, user.tenantId, {
          userId: userId as string,
          phone: phone as string | undefined,
          skills: Array.isArray(skills) ? (skills as string[]) : undefined,
          zoneId: zoneId as string | undefined,
          compensationModel: compensationModel as CompensationModel | undefined,
          monthlySalary:
            monthlySalary !== undefined ? Number(monthlySalary) : undefined,
        });
        return NextResponse.json(profile, { status: 201 });
      } catch (err) {
        const message = err instanceof Error ? err.message : "Failed to create technician profile";
        return NextResponse.json({ error: message }, { status: 400 });
      }
    }
  )(req);
}