import { NextRequest, NextResponse } from 'next/server';
import { getCachedFirm } from '@/lib/firm-catalog';
import { setCredentials, clearCredentials } from '@/lib/db';
import { reconcileClients, removeClient } from '@/lib/clients';

type Params = { params: Promise<{ id: string }> };

/** The platform login for one firm. This is the only firm data this machine
 *  owns — everything else comes from the master catalog, and these credentials
 *  never go the other way.
 *
 *  Tradovate firms need username + password. TopstepX firms need the API key;
 *  username is optional for now (the loginKey call still wants it, so the
 *  client sits idle with a clear error until one is added) and password is
 *  unused. */
export async function PUT(req: NextRequest, { params }: Params) {
    const { id } = await params;

    const firm = getCachedFirm(id);
    if (!firm) return NextResponse.json({ error: 'Firm not found' }, { status: 404 });

    const body = await req.json() as { username?: string; password?: string; apiKey?: string };
    const username = body.username?.trim() ?? '';
    const password = body.password?.trim() ?? '';
    const apiKey = body.apiKey?.trim() ?? '';

    if (firm.platform === 'topstepx') {
        if (!apiKey) {
            return NextResponse.json({ error: 'apiKey is required for a TopstepX firm' }, { status: 400 });
        }
    } else if (!username || !password) {
        return NextResponse.json({ error: 'username and password are required' }, { status: 400 });
    }

    try {
        setCredentials(id, firm.name, username, password, apiKey);
        // Picks up the new login immediately rather than at the next restart.
        reconcileClients();
        return NextResponse.json({ ok: true });
    } catch (err) {
        console.error('[PUT /api/firms/:id/credentials]', err);
        return NextResponse.json({ error: 'Failed to save credentials' }, { status: 500 });
    }
}

export async function DELETE(_req: NextRequest, { params }: Params) {
    const { id } = await params;
    const cleared = clearCredentials(id);
    removeClient(id);
    return NextResponse.json({ ok: cleared });
}