// tdd-guard:skip — Next.js route handler; testable logic lives in
// lib/simvsm-import (pure) + this file's own route.test.ts (behavior).
//
// Wertstrom P6 (KAR-878/KAR-986, execution-prompt §14.2 "pre-import
// preview") — parses uploaded SimVSM file(s), PERSISTS NOTHING (no writes
// anywhere in this handler — the only DB access is the read-only duplicate
// hint). multipart/form-data with a repeated `files` field: `.json` files
// are read and mapped; `.svg` files contribute only their name (never their
// bytes — see lib/simvsm-import/README.md "SVG is metadata-only").
import { NextRequest, NextResponse } from 'next/server'
import { createClient } from '@/lib/supabase/server'
import { getUserSession, hasPermission } from '@/lib/auth/permissions'
import { getProfile } from '@/config/profiles'
import { wertstromSimvsmImportGate } from '@/lib/api/feature-gates'
import { apiError, routeError } from '@/lib/api/error'
import { buildSimvsmImportPreview, checkTotalUploadSize, classifyUploadFile, findSimvsmDuplicatesBySignature } from '@/lib/simvsm-import'

// See lib/simvsm-import/README.md "Größenlimit / Body-Limit". Per-file
// (JSON/SVG) and total-request limits now live in the SHARED
// lib/simvsm-import/internal/upload-limits.ts classifier — the confirm
// route (app/api/wertstrom/import/confirm/route.ts) uses the SAME functions,
// not a copy-pasted re-implementation (Review-Fix, adversarial review PR
// #360, C7+C13+C14+C19). The real corpus's largest file (~13.4 MiB) is
// documented as out of reach for this route either way.
const ROUTE_MAX_FILES = 30

export async function POST(req: NextRequest) {
  try {
  } catch (e) {
    if (e instanceof Response) return e
    throw e
  }

  const gate = wertstromSimvsmImportGate(getProfile().features.wertstromSimvsmImport)
  if (!gate.ok) return apiError.notFound()

  const session = await getUserSession()
  if (!session) return apiError.unauthorized()
  if (!hasPermission(session, 'vsm.read')) return apiError.forbidden()

  let formData: FormData
  try {
    formData = await req.formData()
  } catch {
    return apiError.invalidBody([{ message: 'Kein gültiges multipart/form-data.' }])
  }

  const entries = formData.getAll('files').filter((f): f is File => f instanceof File)
  if (entries.length === 0) {
    return apiError.invalidBody([{ message: 'Keine Dateien übermittelt (Feld "files").' }])
  }
  if (entries.length > ROUTE_MAX_FILES) {
    return apiError.invalidBody([{ message: `Zu viele Dateien in einer Anfrage (maximal ${ROUTE_MAX_FILES}).` }])
  }

  // GESAMT-Limit zuerst, vor jeder Einzeldatei-Verarbeitung (`.size` ist ohne
  // Byte-Lesen verfügbar) — hartes Reject mit ehrlicher Meldung, statt sich
  // auf Vercels eigenen (für den Client inhaltsleeren) Plattform-Reject zu
  // verlassen. Gleiche Stil-Konvention wie der ROUTE_MAX_FILES-Check oben.
  const totalBytes = entries.reduce((sum, f) => sum + f.size, 0)
  const totalCheck = checkTotalUploadSize(totalBytes)
  if (!totalCheck.ok) {
    return apiError.invalidBody([{ message: totalCheck.messageDe }])
  }

  const svgFileNames: string[] = []
  const rejectedFiles: { fileName: string; sizeBytes: number; limitBytes: number; reason: 'oversized' | 'unsupported_extension'; messageDe: string }[] = []
  const jsonFiles: { fileName: string; text: string }[] = []

  for (const file of entries) {
    const fileName = file.name || 'unbenannt'
    // Reihenfolge (C7/C13/C14): Endungs-/Typ-Check IMMER vor dem Größen-
    // Check — classifyUploadFile selbst erzwingt das, damit eine falsche
    // Endung nie als „zu groß" gemeldet wird.
    const check = classifyUploadFile({ fileName, sizeBytes: file.size })
    if (!check.ok) {
      rejectedFiles.push({ fileName: check.fileName, sizeBytes: check.sizeBytes, limitBytes: check.limitBytes, reason: check.reason, messageDe: check.messageDe })
      continue
    }
    if (check.kind === 'svg') {
      svgFileNames.push(fileName)
      continue
    }
    jsonFiles.push({ fileName, text: await file.text() })
  }

  const preview = buildSimvsmImportPreview({ jsonFiles, svgFileNames })

  const signatures = preview.families.filter((f) => f.parseOk).map((f) => f.sourceSignature)
  const duplicates = await findSimvsmDuplicatesBySignature(await createClient(), signatures)

  const families = preview.families.map((family) => ({
    ...family,
    duplicateOf: duplicates.bySignature[family.sourceSignature] ?? null,
    duplicateCheckDegraded: duplicates.degraded,
  }))

  try {
    return NextResponse.json({
      parserVersion: preview.parserVersion,
      mappingVersion: preview.mappingVersion,
      families,
      orphanSvgFileNames: preview.orphanSvgFileNames,
      rejectedFiles,
    })
  } catch (error) {
    return routeError('Vorschau konnte nicht erstellt werden.', error)
  }
}