import { requireAuth } from '~/server/utils/auth'
import { prisma } from '~/server/utils/prisma'

export default defineEventHandler(async (event) => {
  const adminUser = requireAuth(event)
  const groupId = getRouterParam(event, 'id')
  const body = await readBody(event)
  const { userId, role } = body

  if (!groupId || !userId || !role) {
    throw createError({ statusCode: 400, message: 'Missing required fields' })
  }

  // 1. Проверяем права: только владелец группы или глобальный админ может менять роли
  const group = await prisma.group.findUnique({
    where: { id: groupId }
  })

  if (!group || (group.ownerId !== adminUser.id && adminUser.role !== 'admin')) {
    throw createError({ statusCode: 403, message: 'Permission denied' })
  }

  // 2. Нельзя менять роль самому владельцу (он всегда админ)
  if (userId === group.ownerId) {
    throw createError({ statusCode: 400, message: 'Cannot change owner role' })
  }

  // 3. Обновляем роль
  try {
    const updated = await prisma.groupMember.update({
      where: {
        userId_groupId: { userId, groupId }
      },
      data: { role }
    })

    return { success: true, updated }
  } catch (e) {
    throw createError({ statusCode: 500, message: 'Failed to update member role' })
  }
})