WFDASH-WEBAPP/src/app/api/v1/stock/route.ts

import { NextRequest, NextResponse } from "next/server";
import { assertAgentAuth } from "@/lib/server/agent-auth";
import { getAdminPocketBase } from "@/lib/server/pocketbase-admin";

/**
 * GET /api/v1/stock
 *
 * List stock_items (warehouse stock).
 *
 * Auth: same as the rest of `/api/v1` — `Authorization: Bearer <AGENT_API_KEY>`.
 *
 * Query params:
 *   page, perPage  — pagination (defaults 1 / 50, `perPage` max 500)
 *   sort           — PocketBase sort expression (default `-created`)
 *   filter         — PocketBase filter expression (passed through unchanged)
 *   fields         — comma-separated PB field projection
 *   expand         — comma-separated list of relation fields to inline
 *
 * This handler intentionally only exposes `GET (list)` at the bare
 * collection route. Create / update / delete are scoped to the per-id
 * route (`/api/v1/stock/[id]`) so a bare token can't bulk-mutate.
 */

export const runtime = "nodejs";
export const dynamic = "force-dynamic";

export async function GET(req: NextRequest) {
  try {
    assertAgentAuth(req);
    const pb = await getAdminPocketBase();

    const page = Number(req.nextUrl.searchParams.get("page") || "1");
    const perPage = Math.min(
      500,
      Number(req.nextUrl.searchParams.get("perPage") || "50"),
    );
    const sort = req.nextUrl.searchParams.get("sort") || "-created";
    const filter = req.nextUrl.searchParams.get("filter") || "";
    const fields = req.nextUrl.searchParams.get("fields") || undefined;
    const expand = req.nextUrl.searchParams.get("expand") || undefined;

    const result = await pb
      .collection("stock_items")
      .getList(page, perPage, { sort, filter, fields, expand });

    return NextResponse.json(result);
  } catch (error) {
    const message =
      error instanceof Error ? error.message : "Failed to fetch stock";
    const status = (error as Error & { status?: number }).status || 500;
    return NextResponse.json({ error: message }, { status });
  }
}