WFDASH-WEBAPP/src/app/api/v1/visits/route.ts

import { NextRequest, NextResponse } from "next/server";
import { getBrowserSessionUser } from "@/lib/server/browser-session";
import {
  recordVisits,
  type PositionSource,
  type RecordVisitInput,
} from "@/lib/server/visits-service";

const SOURCES: PositionSource[] = ["phone", "tracker", "manual"];

/**
 * POST /api/v1/visits — record a rep check-in.
 *
 * Authenticated with the **browser session**, not `AGENT_API_KEY`: the
 * caller is a logged-in rep on their phone. The rep id comes from the
 * validated session rather than the request body, so a client can't
 * log a visit as someone else.
 *
 * A plain route rather than a Server Action because the rep PWA
 * replays queued check-ins from an offline outbox — a `fetch` is
 * trivial to retry from stored JSON, whereas a Server Action is bound
 * to the React runtime that queued it.
 *
 * Body:
 *   {
 *     lat, lon            required, decimal degrees
 *     positionSource      "phone" | "tracker" | "manual"
 *     accuracyM?          GPS accuracy in metres
 *     fixAgeSeconds?      how old the fix was
 *     visitedAt?          ISO; set by the phone when the check-in was
 *                         *made*, which for a queued submission is
 *                         hours before it reaches us
 *     visits: [{ customerId, notes?, pinCustomer? }]
 *   }
 *
 * Idempotency is deliberately not attempted here — see the outbox in
 * the rep PWA, which only removes an entry once the server has
 * acknowledged it, and surfaces duplicates to the rep rather than
 * silently merging them.
 */
export async function POST(req: NextRequest) {
  try {
    const user = await getBrowserSessionUser(req);

    const body = (await req.json().catch(() => null)) as {
      lat?: unknown;
      lon?: unknown;
      positionSource?: unknown;
      accuracyM?: unknown;
      fixAgeSeconds?: unknown;
      visitedAt?: unknown;
      visits?: unknown;
    } | null;

    if (!body || typeof body !== "object") {
      return NextResponse.json({ error: "JSON object body required" }, { status: 400 });
    }

    const { lat, lon } = body;
    if (typeof lat !== "number" || typeof lon !== "number") {
      return NextResponse.json(
        { error: "lat and lon are required as numbers" },
        { status: 400 }
      );
    }

    const positionSource = SOURCES.includes(body.positionSource as PositionSource)
      ? (body.positionSource as PositionSource)
      : "phone";

    if (!Array.isArray(body.visits) || body.visits.length === 0) {
      return NextResponse.json(
        { error: "visits must be a non-empty array" },
        { status: 400 }
      );
    }

    const visits: RecordVisitInput[] = [];
    for (const entry of body.visits) {
      if (!entry || typeof entry !== "object") continue;
      const { customerId, notes, pinCustomer } = entry as Record<string, unknown>;
      if (typeof customerId !== "string" || !customerId) continue;
      visits.push({
        customerId,
        notes: typeof notes === "string" ? notes : undefined,
        pinCustomer: pinCustomer === true,
      });
    }

    if (visits.length === 0) {
      return NextResponse.json(
        { error: "no valid customer ids in visits" },
        { status: 400 }
      );
    }

    const result = await recordVisits({
      repId: user.id,
      lat,
      lon,
      positionSource,
      accuracyM: typeof body.accuracyM === "number" ? body.accuracyM : null,
      fixAgeSeconds:
        typeof body.fixAgeSeconds === "number" ? body.fixAgeSeconds : null,
      visitedAt: typeof body.visitedAt === "string" ? body.visitedAt : undefined,
      visits,
    });

    return NextResponse.json(result);
  } catch (error) {
    const message = error instanceof Error ? error.message : "Failed to record visits";
    const status = (error as Error & { status?: number }).status || 500;
    return NextResponse.json({ error: message }, { status });
  }
}