import { NextResponse } from "next/server";
import { db } from "@/lib/db";
import { cookies } from "next/headers";
import jwt from "jsonwebtoken";

const SECRET = process.env.JWT_SECRET!;

export async function PUT(request: Request) {
  try {
    const body = await request.json();
    const cookieStore = await cookies();
    const token = cookieStore.get("token")?.value;

    if (!token) {
      return NextResponse.json({ error: "No autorizado" }, { status: 401 });
    }

    const sessionUser: any = jwt.verify(token, SECRET);

    // Desestructuramos los campos que vienen del modal de edición
    const {
      id, first_name, last_name_paternal, last_name_maternal,
      birth_date, sex, curp, elector_key, phone,
      postal_code, section_number, neighborhood,
      street, ext_number, int_number, reference_text, notes
    } = body;

    // Validación básica: Solo el creador o un admin/líder deberían editar
    // Primero verificamos quién es el dueño del registro
    const [militant]: any = await db.query(
      "SELECT created_by FROM militants WHERE id = ?",
      [id]
    );

    if (militant.length === 0) {
      return NextResponse.json({ error: "Militante no encontrado" }, { status: 404 });
    }

    // Seguridad: Si es brigadista, solo puede editar sus propios registros
    if (sessionUser.role === 'brigadist' && militant[0].created_by !== sessionUser.id) {
      return NextResponse.json({ error: "No tienes permiso para editar este registro" }, { status: 403 });
    }

    // Ejecutamos la actualización
    const query = `
      UPDATE militants SET 
        first_name = ?, last_name_paternal = ?, last_name_maternal = ?,
        birth_date = ?, sex = ?, curp = ?, elector_key = ?, phone = ?,
        postal_code = ?, section_number = ?, neighborhood = ?,
        street = ?, ext_number = ?, int_number = ?, 
        reference_text = ?, notes = ?
      WHERE id = ?
    `;

    const values = [
      first_name, last_name_paternal, last_name_maternal,
      birth_date.split('T')[0], // Limpiamos formato de fecha si viene con ISO
      sex, curp, elector_key, phone,
      postal_code, section_number, neighborhood,
      street, ext_number, int_number, 
      reference_text, notes,
      id
    ];

    await db.query(query, values);

    return NextResponse.json({ message: "Registro actualizado correctamente" });

  } catch (error: any) {
    console.error("UPDATE_ERROR:", error);
    return NextResponse.json({ error: "Error al actualizar el registro" }, { status: 500 });
  }
}