// tdd-guard:skip — Next.js route handler; testable logic lives in lib/projects/project-id.ts tests.
import { NextRequest, NextResponse } from 'next/server'
import { createAdminClient } from '@/lib/supabase/admin'
import { getUserSession } from '@/lib/auth/permissions'
import { routeError } from '@/lib/api/error'
import { previewNextProjectCode, allocateNextProjectCode } from '@/lib/projects/project-id'

export async function POST(req: NextRequest) {
  const session = await getUserSession()
  if (!session) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })

  const body = await req.json().catch(() => ({} as Record<string, unknown>))
  const preview = body?.preview === true

  try {
    const admin = createAdminClient()

    // Preview mode: read the counter WITHOUT consuming an id. Used when the
    // "Neues Projekt" form opens so an abandoned form never burns a number.
    // The value is non-binding — the real id is allocated on save (preview:false).
    if (preview) {
      const result = await previewNextProjectCode(admin, new Date().getFullYear())
      if (!result.ok) return routeError('Projekt-ID-Vorschau konnte nicht geladen werden.', result.error)
      return NextResponse.json({ project_code: result.projectCode, preview: true })
    }

    // Allocation mode: atomically consume the next id (called on save only).
    const result = await allocateNextProjectCode(admin)
    if (!result.ok) return routeError('Projekt-ID konnte nicht generiert werden.', result.error)
    return NextResponse.json({ project_code: result.projectCode })
  } catch (e) {
    return routeError('Projekt-ID konnte nicht generiert werden.', e)
  }
}