hotelsync/backend/src/routes/tariffs.ts

import { FastifyPluginAsync } from 'fastify'
import { db } from '../db'

type SlugParam   = { Params: { slug: string } }
type SlugIdParam = { Params: { slug: string; id: string } }

const tariffs: FastifyPluginAsync = async (fastify) => {
  const getHotelId = async (slug: string): Promise<string | null> => {
    const { rows } = await db.query('SELECT id FROM hotels WHERE slug = $1', [slug])
    return rows[0]?.id ?? null
  }

  const canAccess = (userSlug: string | null, role: string, slug: string) =>
    role === 'super_admin' || userSlug === slug

  // GET /api/hotels/:slug/tariffs
  fastify.get<SlugParam>(
    '/api/hotels/:slug/tariffs',
    { onRequest: [fastify.authenticate] },
    async (request, reply) => {
      const { slug } = request.params
      if (!canAccess(request.user.hotelSlug, request.user.role, slug))
        return reply.code(403).send({ error: 'Forbidden' })
      const hotelId = await getHotelId(slug)
      if (!hotelId) return reply.code(404).send({ error: 'Hotel not found' })
      const { rows } = await db.query(
        `SELECT * FROM tariffs WHERE hotel_id = $1 ORDER BY is_active DESC, created_at`,
        [hotelId],
      )
      return rows
    },
  )

  // POST /api/hotels/:slug/tariffs
  fastify.post<SlugParam & { Body: {
    name: string; code: string; meal_plan?: string; inclusions?: string[]
    modifier_type?: string; modifier_value?: number; min_nights?: number
    cancellation_policy?: string; description?: string; is_active?: boolean
  } }>(
    '/api/hotels/:slug/tariffs',
    { onRequest: [fastify.authenticate] },
    async (request, reply) => {
      const { slug } = request.params
      if (!canAccess(request.user.hotelSlug, request.user.role, slug))
        return reply.code(403).send({ error: 'Forbidden' })
      const hotelId = await getHotelId(slug)
      if (!hotelId) return reply.code(404).send({ error: 'Hotel not found' })
      const {
        name, code,
        meal_plan = 'no_meals', inclusions = [],
        modifier_type = 'fixed', modifier_value = 0, min_nights = 1,
        cancellation_policy = 'flexible', description = '', is_active = true,
      } = request.body
      const { rows } = await db.query(
        `INSERT INTO tariffs
           (hotel_id, name, code, meal_plan, inclusions, modifier_type, modifier_value,
            min_nights, cancellation_policy, description, is_active)
         VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11) RETURNING *`,
        [hotelId, name, code, meal_plan, inclusions, modifier_type, modifier_value,
         min_nights, cancellation_policy, description, is_active],
      )
      return reply.code(201).send(rows[0])
    },
  )

  // PATCH /api/hotels/:slug/tariffs/:id
  fastify.patch<SlugIdParam & { Body: {
    name?: string; code?: string; meal_plan?: string; inclusions?: string[]
    modifier_type?: string; modifier_value?: number; min_nights?: number
    cancellation_policy?: string; description?: string; is_active?: boolean
  } }>(
    '/api/hotels/:slug/tariffs/:id',
    { onRequest: [fastify.authenticate] },
    async (request, reply) => {
      const { slug, id } = request.params
      if (!canAccess(request.user.hotelSlug, request.user.role, slug))
        return reply.code(403).send({ error: 'Forbidden' })
      const hotelId = await getHotelId(slug)
      if (!hotelId) return reply.code(404).send({ error: 'Hotel not found' })
      const b = request.body
      const sets: string[] = ['updated_at = NOW()']
      const vals: unknown[] = [hotelId, id]
      let i = 3
      if (b.name                !== undefined) { sets.push(`name = $${i++}`);                vals.push(b.name) }
      if (b.code                !== undefined) { sets.push(`code = $${i++}`);                vals.push(b.code) }
      if (b.meal_plan           !== undefined) { sets.push(`meal_plan = $${i++}`);           vals.push(b.meal_plan) }
      if (b.inclusions          !== undefined) { sets.push(`inclusions = $${i++}`);          vals.push(b.inclusions) }
      if (b.modifier_type       !== undefined) { sets.push(`modifier_type = $${i++}`);       vals.push(b.modifier_type) }
      if (b.modifier_value      !== undefined) { sets.push(`modifier_value = $${i++}`);      vals.push(b.modifier_value) }
      if (b.min_nights          !== undefined) { sets.push(`min_nights = $${i++}`);          vals.push(b.min_nights) }
      if (b.cancellation_policy !== undefined) { sets.push(`cancellation_policy = $${i++}`); vals.push(b.cancellation_policy) }
      if (b.description         !== undefined) { sets.push(`description = $${i++}`);         vals.push(b.description) }
      if (b.is_active           !== undefined) { sets.push(`is_active = $${i++}`);           vals.push(b.is_active) }
      const { rows } = await db.query(
        `UPDATE tariffs SET ${sets.join(', ')} WHERE hotel_id=$1 AND id=$2 RETURNING *`,
        vals,
      )
      if (!rows[0]) return reply.code(404).send({ error: 'Not found' })
      return rows[0]
    },
  )

  // DELETE /api/hotels/:slug/tariffs/:id
  fastify.delete<SlugIdParam>(
    '/api/hotels/:slug/tariffs/:id',
    { onRequest: [fastify.authenticate] },
    async (request, reply) => {
      const { slug, id } = request.params
      if (!canAccess(request.user.hotelSlug, request.user.role, slug))
        return reply.code(403).send({ error: 'Forbidden' })
      const hotelId = await getHotelId(slug)
      if (!hotelId) return reply.code(404).send({ error: 'Hotel not found' })
      await db.query('DELETE FROM tariffs WHERE hotel_id=$1 AND id=$2', [hotelId, id])
      return reply.code(204).send()
    },
  )
}

export default tariffs