import { NextResponse } from "next/server";
import { prisma } from "@/lib/prisma";
import { requireRole } from "@/lib/auth";
import { sanitizeCollectionAccount } from "@/lib/collection-account";

/* Control Panel → the institution's receiving accounts (mobile banking
   wallets, bank accounts, cash-office info). Members see the active ones
   on their Fees page so they know where to pay. */

export async function GET() {
  const session = await requireRole("INSTITUTION_ADMIN");
  if (!session?.institutionId) {
    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
  }
  const accounts = await prisma.collectionAccount.findMany({
    where: { institutionId: session.institutionId },
    orderBy: [{ sortOrder: "asc" }, { id: "asc" }],
  });
  return NextResponse.json({ accounts });
}

export async function POST(req: Request) {
  const session = await requireRole("INSTITUTION_ADMIN");
  if (!session?.institutionId) {
    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
  }
  const body = (await req.json().catch(() => ({}))) as Record<string, unknown>;
  const parsed = sanitizeCollectionAccount(body);
  if ("error" in parsed) return NextResponse.json({ error: parsed.error }, { status: 400 });
  const account = await prisma.collectionAccount.create({
    data: { ...parsed.data, institutionId: session.institutionId },
  });
  return NextResponse.json({ account });
}