import { NextResponse } from "next/server";
import type { NextRequest } from "next/server";
import { getSessionClientId } from "@/lib/auth";
import { isAdminSession, hasPermission } from "@/lib/adminAuth";
import { connectDB } from "@/lib/db";
import { OrderFeedback } from "@/models/OrderFeedback";
import { corsHeaders, corsPreflight } from "@/lib/teamApiCors";

export async function OPTIONS(request: NextRequest) {
  return corsPreflight(request);
}

// Pendant zu admin/feedback/page.tsx — dieselbe Berechtigung (orders_view).
export async function GET(request: NextRequest) {
  const headers = corsHeaders(request);
  const clientId = await getSessionClientId();
  if (!clientId || !(await isAdminSession())) {
    return NextResponse.json({ error: "Nicht angemeldet." }, { status: 401, headers });
  }
  if (!(await hasPermission("orders_view"))) {
    return NextResponse.json({ error: "Keine Berechtigung." }, { status: 403, headers });
  }

  await connectDB();
  const all = await OrderFeedback.find({ submitted: true }).sort({ submittedAt: -1 }).lean();
  const sentCount = await OrderFeedback.countDocuments({});

  const items = all.map((item) => ({
    id: String(item._id),
    clientName: item.clientName,
    shootingType: item.shootingType,
    rating: item.rating,
    comment: item.comment,
    allowTestimonial: item.allowTestimonial,
    usedForTestimonial: item.usedForTestimonial,
    usedForQuickReview: item.usedForQuickReview,
    submittedAt: item.submittedAt ? item.submittedAt.toISOString() : null,
    orderId: String(item.orderId),
  }));

  return NextResponse.json({ items, sentCount }, { headers });
}