OpenFrame/app/api/approvals/[requestId]/decision/route.ts

import { NextRequest } from 'next/server';
import { Prisma } from '@prisma/client';
import { auth, checkProjectAccess } from '@/lib/auth';
import { db } from '@/lib/db';
import { notifyUsers } from '@/lib/notifications';
import { rateLimit } from '@/lib/rate-limit';
import { apiErrors, successResponse, withCacheControl } from '@/lib/api-response';
import { logError } from '@/lib/logger';

type RouteParams = { params: Promise<{ requestId: string }> };

function isSerializableConflict(error: unknown): boolean {
  return error instanceof Prisma.PrismaClientKnownRequestError && error.code === 'P2034';
}

// POST /api/approvals/[requestId]/decision
export async function POST(request: NextRequest, { params }: RouteParams) {
  try {
    const limited = await rateLimit(request, 'mutate');
    if (limited) return limited;

    const session = await auth();
    if (!session?.user?.id) return apiErrors.unauthorized();

    const { requestId } = await params;
    const body = await request.json().catch(() => ({}));
    const decision = body.decision;
    if (decision !== 'APPROVED' && decision !== 'REJECTED') {
      return apiErrors.badRequest('Decision must be APPROVED or REJECTED');
    }

    const note = typeof body.note === 'string' ? body.note.trim() : '';
    if (note.length > 2000) {
      return apiErrors.badRequest('Note must be 2000 characters or fewer');
    }

    const approvalRequest = await db.approvalRequest.findUnique({
      where: { id: requestId },
      include: {
        version: {
          include: {
            video: {
              include: {
                project: {
                  select: {
                    id: true,
                    name: true,
                    ownerId: true,
                    workspaceId: true,
                    visibility: true,
                  },
                },
              },
            },
          },
        },
        decisions: {
          where: { approverId: session.user.id },
          select: { id: true, status: true },
        },
      },
    });
    if (!approvalRequest) return apiErrors.notFound('Approval request');

    const access = await checkProjectAccess(approvalRequest.version.video.project, session.user.id);
    if (!access.hasAccess) return apiErrors.forbidden('Access denied');

    const myDecision = approvalRequest.decisions[0];
    if (!myDecision) return apiErrors.forbidden('You are not an approver on this request');
    if (approvalRequest.status !== 'PENDING') {
      return apiErrors.conflict('This approval request is no longer pending');
    }
    if (myDecision.status !== 'PENDING') {
      return apiErrors.conflict('You have already responded to this request');
    }

    const updated = await db.$transaction(
      async (tx) => {
        const currentRequest = await tx.approvalRequest.findUnique({
          where: { id: requestId },
          include: {
            decisions: {
              orderBy: { createdAt: 'asc' },
              include: {
                approver: { select: { id: true, name: true, email: true, image: true } },
              },
            },
            requestedBy: { select: { id: true, name: true, email: true, image: true } },
            version: {
              include: {
                video: {
                  include: {
                    project: { select: { id: true, name: true } },
                  },
                },
              },
            },
          },
        });
        if (!currentRequest) {
          throw new Error('__NOT_FOUND__');
        }
        if (currentRequest.status !== 'PENDING') {
          throw new Error('__NOT_PENDING__');
        }

        const decisionRow = await tx.approvalDecision.findUnique({
          where: { requestId_approverId: { requestId, approverId: session.user.id } },
          select: { status: true },
        });
        if (!decisionRow) throw new Error('__NOT_APPROVER__');
        if (decisionRow.status !== 'PENDING') throw new Error('__ALREADY_RESPONDED__');

        await tx.approvalDecision.update({
          where: { requestId_approverId: { requestId, approverId: session.user.id } },
          data: {
            status: decision,
            note: note || null,
            respondedAt: new Date(),
          },
        });

        if (decision === 'REJECTED') {
          await tx.approvalRequest.update({
            where: { id: requestId },
            data: {
              status: 'REJECTED',
              resolvedAt: new Date(),
            },
          });
        } else {
          const pendingCount = await tx.approvalDecision.count({
            where: { requestId, status: 'PENDING' },
          });
          const rejectedCount = await tx.approvalDecision.count({
            where: { requestId, status: 'REJECTED' },
          });
          if (pendingCount === 0 && rejectedCount === 0) {
            await tx.approvalRequest.update({
              where: { id: requestId },
              data: {
                status: 'APPROVED',
                resolvedAt: new Date(),
              },
            });
          }
        }

        return tx.approvalRequest.findUnique({
          where: { id: requestId },
          include: {
            requestedBy: { select: { id: true, name: true, email: true, image: true } },
            canceledBy: { select: { id: true, name: true, email: true, image: true } },
            decisions: {
              orderBy: { createdAt: 'asc' },
              include: {
                approver: { select: { id: true, name: true, email: true, image: true } },
              },
            },
            version: {
              include: {
                video: {
                  include: {
                    project: { select: { id: true, name: true } },
                  },
                },
              },
            },
          },
        });
      },
      {
        isolationLevel: Prisma.TransactionIsolationLevel.Serializable,
      }
    );

    if (!updated) return apiErrors.notFound('Approval request');

    const actorName = session.user.name || 'A team member';
    const versionLabel = updated.version.versionLabel || `Version ${updated.version.versionNumber}`;
    const baseUrl = process.env.NEXTAUTH_URL || '';
    const requestUrl = `${baseUrl}/projects/${updated.version.video.project.id}/videos/${updated.version.video.id}`;

    notifyUsers([updated.requestedById], {
      type: 'approval_action',
      projectName: updated.version.video.project.name,
      videoTitle: updated.version.video.title,
      versionLabel,
      actorName,
      action: decision === 'APPROVED' ? 'approved' : 'rejected',
      note: note || undefined,
      url: requestUrl,
    }).catch((error) => {
      logError('Approval action notification failed:', error);
    });

    if (updated.status === 'APPROVED') {
      notifyUsers([updated.requestedById], {
        type: 'approval_completed',
        projectName: updated.version.video.project.name,
        videoTitle: updated.version.video.title,
        versionLabel,
        approvedByCount: updated.decisions.filter((item) => item.status === 'APPROVED').length,
        url: requestUrl,
      }).catch((error) => {
        logError('Approval completed notification failed:', error);
      });
    } else if (updated.status === 'REJECTED') {
      notifyUsers([updated.requestedById], {
        type: 'approval_rejected',
        projectName: updated.version.video.project.name,
        videoTitle: updated.version.video.title,
        versionLabel,
        rejectedBy: actorName,
        note: note || undefined,
        url: requestUrl,
      }).catch((error) => {
        logError('Approval rejected notification failed:', error);
      });
    }

    const response = successResponse({ request: updated });
    return withCacheControl(response, 'private, no-store');
  } catch (error) {
    if (error instanceof Error) {
      if (error.message === '__NOT_PENDING__')
        return apiErrors.conflict('This approval request is no longer pending');
      if (error.message === '__ALREADY_RESPONDED__')
        return apiErrors.conflict('You have already responded to this request');
      if (error.message === '__NOT_APPROVER__')
        return apiErrors.forbidden('You are not an approver on this request');
      if (error.message === '__NOT_FOUND__') return apiErrors.notFound('Approval request');
    }
    if (isSerializableConflict(error)) {
      return apiErrors.conflict('Request state changed. Please try again.');
    }
    logError('Error responding to approval request:', error);
    return apiErrors.internalError('Failed to respond to approval request');
  }
}