import { NextRequest, NextResponse } from 'next/server'
import { getUserSession } from '@/lib/auth/permissions'
import { apiError } from '@/lib/api/error'
import { NotifyUserBody } from '@/lib/api/schemas'
import { queueEmail } from '@/lib/email/notifications'
import { checkCsrf } from '@/lib/security'

export async function POST(request: NextRequest) {
  const csrf = checkCsrf(request); if (csrf) return csrf
  const session = await getUserSession()
  if (!session) return apiError.unauthorized()
  if (session.role !== 'admin' && session.role !== 'masteradmin') return apiError.forbidden()

  const parsed = NotifyUserBody.safeParse(await request.json().catch(() => ({})))
  if (!parsed.success) return apiError.invalidBody(parsed.error.issues)
  const { template, email, templateData } = parsed.data

  await queueEmail(email, template, templateData ?? {})

  return NextResponse.json({ ok: true })
}