import { requireAuth } from '~/server/utils/auth'
import { prisma } from '~/server/utils/prisma'

export default defineEventHandler(async (event) => {
  const user = requireAuth(event)
  const id = getRouterParam(event, 'id')
  if (!id) throw createError({ statusCode: 400, message: 'Canvas ID is required' })

  const body = await readBody(event)

  const existing = await prisma.canvas.findUnique({ where: { id } })
  if (!existing) throw createError({ statusCode: 404, message: 'Canvas not found' })
  
  // 1. Проверка прав
  let canEdit = existing.ownerId === user.id || user.role === 'admin' || existing.isPublic

  if (!canEdit && existing.groupId) {
    const membership = await prisma.groupMember.findUnique({
      where: {
        userId_groupId: { userId: user.id, groupId: existing.groupId }
      }
    })
    // Редакторы и админы группы могут править
    if (membership && (membership.role === 'admin' || membership.role === 'editor')) {
      canEdit = true
    }
  }

  if (!canEdit) {
    throw createError({ statusCode: 403, message: 'У вас недостаточно прав для редактирования этой карты' })
  }

  const { name, nodes, edges, isPublic, groupId } = body
  const canvas = await prisma.canvas.update({
    where: { id },
    data: {
      ...(name !== undefined && { name }),
      ...(nodes !== undefined && { nodes }),
      ...(edges !== undefined && { edges }),
      ...(isPublic !== undefined && { isPublic }),
      ...(groupId !== undefined && { groupId: groupId || null })
    }
  })

  return { canvas }
})