import type { APIRoute } from "astro";
import { updateItem } from "@directus/sdk";
import { isLoggedIn } from "../../../lib/auth";

export const POST: APIRoute = async ({ request, locals }) => {
    if (!isLoggedIn(locals)) {
        return new Response(JSON.stringify({ error: "Unauthorized" }), {
            status: 401,
            headers: { "Content-Type": "application/json" },
        });
    }

    try {
        const { friendshipId } = await request.json();
        const id = Number(friendshipId);

        if (!id || Number.isNaN(id)) {
            return new Response(
                JSON.stringify({ error: "Missing friendship id" }),
                {
                    status: 400,
                    headers: { "Content-Type": "application/json" },
                },
            );
        }

        // Only the addressee can decline — enforced by the Directus update
        // permission (addressee = $CURRENT_USER, status field only).
        await locals.directus!.request(
            updateItem("friendships", id, { status: "declined" }),
        );

        return new Response(JSON.stringify({ success: true }), {
            status: 200,
            headers: { "Content-Type": "application/json" },
        });
    } catch (err: any) {
        console.error("Decline friend failed:", err);
        const forbidden =
            err?.errors?.[0]?.extensions?.code === "FORBIDDEN" ||
            err?.response?.status === 403;
        return new Response(
            JSON.stringify({
                error: forbidden ? "Forbidden" : "Failed to decline",
            }),
            {
                status: forbidden ? 403 : 500,
                headers: { "Content-Type": "application/json" },
            },
        );
    }
};