import { NextResponse } from "next/server";
import { getPayload } from "payload";
import config from "@payload-config";

export const dynamic = "force-dynamic";

type Args = { params: Promise<{ id: string }> };

export async function POST(request: Request, { params }: Args) {
  const { id } = await params;

  try {
    const payload = await getPayload({ config });
    const { user } = await payload.auth({ headers: request.headers });
    if (!user || user.collection !== "customers") {
      return NextResponse.json({ error: "Bitte melde dich an." }, { status: 401 });
    }
    // Cancelling is deliberately allowed regardless of verification status —
    // only creating/confirming a booking is a gated "protected" action.

    const booking = await payload.findByID({ collection: "booking-requests", id, depth: 0 }).catch(() => null);
    if (!booking || Number(booking.user) !== Number(user.id)) {
      return NextResponse.json({ error: "Buchung nicht gefunden." }, { status: 404 });
    }
    if (booking.status === "cancelled") {
      return NextResponse.json({ ok: true });
    }

    await payload.update({ collection: "booking-requests", id, data: { status: "cancelled" } });
    return NextResponse.json({ ok: true });
  } catch (error) {
    console.error("booking cancel failed", error);
    return NextResponse.json({ error: "Der Termin konnte nicht storniert werden." }, { status: 500 });
  }
}