hotelsync/backend/src/routes/channels.ts

import { FastifyPluginAsync } from 'fastify'
import { db } from '../db'

type SlugParam   = { Params: { slug: string } }
type SlugIdParam = { Params: { slug: string; id: string } }

const channels: FastifyPluginAsync = async (fastify) => {
  const getHotelId = async (slug: string): Promise<string | null> => {
    const { rows } = await db.query('SELECT id FROM hotels WHERE slug = $1', [slug])
    return rows[0]?.id ?? null
  }

  const canAccess = (userSlug: string | null, role: string, slug: string) =>
    role === 'super_admin' || userSlug === slug

  // ── GET /api/hotels/:slug/channels ─────────────────────────────────────────
  fastify.get<SlugParam>(
    '/api/hotels/:slug/channels',
    { onRequest: [fastify.authenticate] },
    async (request, reply) => {
      const { slug } = request.params
      if (!canAccess(request.user.hotelSlug, request.user.role, slug)) {
        return reply.code(403).send({ error: 'Forbidden' })
      }
      const hotelId = await getHotelId(slug)
      if (!hotelId) return reply.code(404).send({ error: 'Hotel not found' })

      const { rows } = await db.query(
        `SELECT id, hotel_id, name, enabled, hotel_external_id, last_synced_at
           FROM channels WHERE hotel_id = $1 ORDER BY name`,
        [hotelId],
      )
      // api_key_encrypted is never returned to client
      return rows
    },
  )

  // ── PATCH /api/hotels/:slug/channels/:id ──────────────────────────────────
  fastify.patch<SlugIdParam & { Body: {
    enabled?: boolean; api_key?: string; hotel_external_id?: string
  } }>(
    '/api/hotels/:slug/channels/:id',
    { onRequest: [fastify.authenticate] },
    async (request, reply) => {
      if (!['manager', 'super_admin'].includes(request.user.role)) {
        return reply.code(403).send({ error: 'Forbidden' })
      }
      const { slug, id } = request.params
      if (!canAccess(request.user.hotelSlug, request.user.role, slug)) {
        return reply.code(403).send({ error: 'Forbidden' })
      }
      const hotelId = await getHotelId(slug)
      if (!hotelId) return reply.code(404).send({ error: 'Hotel not found' })

      const updates: string[] = []
      const values: unknown[] = []
      let idx = 1

      if (request.body.enabled !== undefined) {
        updates.push(`enabled = $${idx}`); values.push(request.body.enabled); idx++
      }
      if (request.body.api_key) {
        // In production you'd encrypt this; for now store as-is
        updates.push(`api_key_encrypted = $${idx}`); values.push(request.body.api_key); idx++
      }
      if (request.body.hotel_external_id !== undefined) {
        updates.push(`hotel_external_id = $${idx}`); values.push(request.body.hotel_external_id); idx++
      }

      if (updates.length === 0) return reply.code(400).send({ error: 'Nothing to update' })
      values.push(id, hotelId)

      const { rows } = await db.query(
        `UPDATE channels SET ${updates.join(', ')}
          WHERE id = $${idx} AND hotel_id = $${idx + 1}
          RETURNING id, hotel_id, name, enabled, hotel_external_id, last_synced_at`,
        values,
      )
      if (!rows[0]) return reply.code(404).send({ error: 'Channel not found' })
      return rows[0]
    },
  )

  // ── POST /api/hotels/:slug/channels/:id/sync ───────────────────────────────
  fastify.post<SlugIdParam>(
    '/api/hotels/:slug/channels/:id/sync',
    { onRequest: [fastify.authenticate] },
    async (request, reply) => {
      if (!['manager', 'super_admin'].includes(request.user.role)) {
        return reply.code(403).send({ error: 'Forbidden' })
      }
      const { slug, id } = request.params
      if (!canAccess(request.user.hotelSlug, request.user.role, slug)) {
        return reply.code(403).send({ error: 'Forbidden' })
      }
      const hotelId = await getHotelId(slug)
      if (!hotelId) return reply.code(404).send({ error: 'Hotel not found' })

      // In production this would call the channel's API.
      // For now, just update last_synced_at
      const { rows } = await db.query(
        `UPDATE channels SET last_synced_at = NOW()
          WHERE id = $1 AND hotel_id = $2
          RETURNING id, name, enabled, last_synced_at`,
        [id, hotelId],
      )
      if (!rows[0]) return reply.code(404).send({ error: 'Channel not found' })
      return { ...rows[0], synced_bookings: 0 }
    },
  )
}

export default channels