import { NextRequest, NextResponse } from "next/server";
import { queryRow } from "@/lib/db";
import { getCurrentUser } from "@/lib/auth";
import { canAccessTransactions } from "@/lib/queries";

/**
 * Order provenance for one transaction.
 *
 * `expense_metadata` has held the itemised receipt since ingestion started and
 * nothing in the UI ever read it — a transaction that came from a DoorDash or
 * Uber Eats receipt showed a merchant and an amount, with the item list and the
 * delivery addresses sitting unread in the row behind it (user, 2026-07-27).
 *
 * Read-only. The receipt is a record of what a provider sent; editing it here
 * would make provenance mean nothing.
 */
export async function GET(
  req: NextRequest,
  { params }: { params: Promise<{ id: string }> }
) {
  const user = await getCurrentUser(req);
  if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 403 });
  const { id } = await params;
  if (!(await canAccessTransactions(user.id, [Number(id)]))) {
    return NextResponse.json({ error: "Forbidden" }, { status: 403 });
  }

  const row = await queryRow(
    `SELECT platform, order_reference, line_items, route, subtotal, amount,
            currency, card_last4, flags, source_email_subject, transaction_date
       FROM expense_metadata
      -- A card-settled order creates no transaction of its own (I5): the
      -- statement line is the transaction, and the receipt points at it
      -- through matched_transaction_id. Both directions have to resolve or the
      -- detail is missing on exactly the orders that were paid by card.
      WHERE transaction_id = $1 OR matched_transaction_id = $1
      LIMIT 1`,
    [Number(id)]
  );

  // Not an order — most transactions aren't. Null, not 404: the caller is
  // asking "is there a receipt behind this?", and "no" is a normal answer.
  return NextResponse.json(row ?? null);
}