import { requireAuth } from '~/server/utils/auth'
import { canvases, userGroups } from '~/server/utils/db'

export default defineEventHandler(async (event) => {
  const id = getRouterParam(event, 'id')

  if (!id) {
    throw createError({ statusCode: 400, message: 'Canvas ID is required' })
  }

  const canvas = canvases.get(id)
  if (!canvas) {
    throw createError({ statusCode: 404, message: 'Canvas not found' })
  }

  // Check if canvas is public
  if (canvas.isPublic) {
    return {
      id: canvas.id,
      name: canvas.name,
      nodes: canvas.nodes,
      edges: canvas.edges,
      isPublic: true,
      ownerId: canvas.ownerId
    }
  }

  // For private canvases, require authentication and check permissions
  const user = requireAuth(event)

  // Check if user owns the canvas
  if (canvas.ownerId === user.id) {
    return {
      id: canvas.id,
      name: canvas.name,
      nodes: canvas.nodes,
      edges: canvas.edges,
      isPublic: false,
      ownerId: canvas.ownerId
    }
  }

  // Check if user has access through group membership
  if (canvas.groupId) {
    const membership = Array.from(userGroups.values()).find(
      m => m.userId === user.id && m.groupId === canvas.groupId
    )
    if (membership) {
      return {
        id: canvas.id,
        name: canvas.name,
        nodes: canvas.nodes,
        edges: canvas.edges,
        isPublic: false,
        ownerId: canvas.ownerId,
        groupId: canvas.groupId
      }
    }
  }

  throw createError({ statusCode: 403, message: 'Access denied' })
})