la-huasca-ts/src/app/api/admin/comments/route.ts

import { NextRequest, NextResponse } from 'next/server';
import { db } from '@/lib/db';
import { requireAuth } from '@/lib/auth';

// GET - list pending comments for admin review
export async function GET(request: NextRequest) {
  try {
    const session = await requireAuth();
    if (session.role !== 'admin') {
      return NextResponse.json({ error: 'Unauthorized' }, { status: 403 });
    }

    const { searchParams } = new URL(request.url);
    const status = searchParams.get('status') || 'pending';

    const { rows } = await db.query(`
      SELECT rc.*, r.name as room_name, u.username
      FROM room_comments rc
      LEFT JOIN rooms r ON rc.room_id = r.id
      LEFT JOIN users u ON rc.user_id = u.id
      WHERE rc.status = $1
      ORDER BY rc.created_at DESC
    `, [status]);

    return NextResponse.json({ comments: rows });
  } catch (err: any) {
    return NextResponse.json({ error: err.message || 'Failed to fetch comments' }, { status: 500 });
  }
}

// PATCH - approve, reject, or edit a comment
export async function PATCH(request: NextRequest) {
  try {
    const session = await requireAuth();
    if (session.role !== 'admin') {
      return NextResponse.json({ error: 'Unauthorized' }, { status: 403 });
    }

    const { comment_id, action, text } = await request.json();

    if (!comment_id || !action) {
      return NextResponse.json({ error: 'comment_id and action required' }, { status: 400 });
    }

    let result;
    
    if (action === 'approve') {
      result = await db.query(`
        UPDATE room_comments SET status = 'approved' WHERE id = $1 RETURNING *
      `, [comment_id]);
    } else if (action === 'reject') {
      result = await db.query(`
        UPDATE room_comments SET status = 'rejected' WHERE id = $1 RETURNING *
      `, [comment_id]);
    } else if (action === 'edit') {
      if (!text) {
        return NextResponse.json({ error: 'text required for edit action' }, { status: 400 });
      }
      result = await db.query(`
        UPDATE room_comments SET text = $1, status = 'approved' WHERE id = $2 RETURNING *
      `, [text, comment_id]);
    } else if (action === 'delete') {
      result = await db.query(`
        UPDATE room_comments SET deleted_by_admin = TRUE WHERE id = $1 RETURNING *
      `, [comment_id]);
    } else {
      return NextResponse.json({ error: 'Invalid action' }, { status: 400 });
    }

    return NextResponse.json({ success: true, comment: result?.rows?.[0] });
  } catch (err: any) {
    return NextResponse.json({ error: err.message || 'Failed to update comment' }, { status: 500 });
  }
}