import { requireAuth } from '~/server/utils/auth'
import { prisma } from '~/server/utils/prisma'

export default defineEventHandler(async (event) => {
  const user = requireAuth(event)
  const body = await readBody(event)
  const { taskId, canvasId, newState } = body

  if (!taskId || !canvasId || !newState) {
    throw createError({ statusCode: 400, message: 'Missing parameters' })
  }

  // 1. Получаем канвас
  const canvas = await prisma.canvas.findUnique({
    where: { id: canvasId }
  })

  if (!canvas) {
    throw createError({ statusCode: 404, message: 'Canvas not found' })
  }

  // 2. Проверяем права на редактирование
  const isOwner = canvas.ownerId === user.id
  let isMember = false
  if (canvas.groupId) {
    const membership = await prisma.groupMember.findFirst({
      where: { userId: user.id, groupId: canvas.groupId }
    })
    isMember = !!membership
  }

  if (!isOwner && !isMember && user.role !== 'admin') {
    throw createError({ statusCode: 403, message: 'No permission to update this task' })
  }

  // 3. Обновляем узел внутри массива nodes
  const nodes = (canvas.nodes as any[]) || []
  const nodeIdx = nodes.findIndex(n => n.id === taskId)

  if (nodeIdx === -1) {
    throw createError({ statusCode: 404, message: 'Task node not found in canvas' })
  }

  // Обновляем состояние
  nodes[nodeIdx].state = newState
  if (nodes[nodeIdx].data) {
    nodes[nodeIdx].data.state = newState
  }

  // 4. Сохраняем обратно в БД
  await prisma.canvas.update({
    where: { id: canvasId },
    data: { nodes }
  })

  return { success: true }
})