la-huasca-ts/src/app/api/social_event_reservations/route.ts

import { db } from '@/lib/db';
import { NextResponse } from 'next/server';
import { requireAuth, requireRole } from '@/lib/auth';

export async function GET(request: Request) {
  try {
    const session = await requireAuth();
    const { searchParams } = new URL(request.url);
    const socialEventId = searchParams.get('social_event_id');
    const status = searchParams.get('status');

    let query = `
      SELECT ser.*, se.name as event_name
      FROM social_event_reservations ser
      JOIN social_events se ON se.id = ser.social_event_id
    `;
    const params: (number | string)[] = [];

    if (session.role === 'admin') {
      const conditions: string[] = [];
      let paramCount = 1;
      
      if (socialEventId) {
        conditions.push(`ser.social_event_id = $${paramCount++}`);
        params.push(parseInt(socialEventId, 10));
      }
      if (status && ['pending', 'confirmed', 'cancelled'].includes(status)) {
        conditions.push(`ser.status = $${paramCount++}`);
        params.push(status);
      }
      
      if (conditions.length > 0) {
        query += ' WHERE ' + conditions.join(' AND ');
      }
    } else {
      query += ' WHERE ser.user_id = $1';
      params.push(session.id);
      if (socialEventId) {
        query += ' AND ser.social_event_id = $2';
        params.push(parseInt(socialEventId, 10));
      }
    }

    query += ' ORDER BY ser.created_at DESC';
    const { rows } = await db.query(query, params);
    return NextResponse.json({ data: rows });
  } catch (error: any) {
    console.error('GET /api/social_event_reservations error:', error);
    return NextResponse.json({ error: error.message || 'Unauthorized' }, { status: 401 });
  }
}

export async function POST(request: Request) {
  try {
    const body = await request.json();
    const { social_event_id, guests, notes, contact_name, contact_email, contact_phone, contact_method } = body;
    
    if (!social_event_id || !guests) {
      return NextResponse.json({ error: 'Missing required fields' }, { status: 400 });
    }

    // Try to authenticate, but allow guest submissions
    let userId: number | null = null;
    try {
      const session = await requireAuth();
      userId = session.id;
    } catch {
      // Guest submission - require contact info
      if (!contact_name || !contact_method) {
        return NextResponse.json({ error: 'Contact name and method required for guest reservations' }, { status: 400 });
      }
      if (!['email', 'phone', 'whatsapp'].includes(contact_method)) {
        return NextResponse.json({ error: 'Invalid contact method' }, { status: 400 });
      }
    }

    const { rows } = await db.query(
      `INSERT INTO social_event_reservations 
       (user_id, social_event_id, guests, notes, status, contact_name, contact_email, contact_phone, contact_method)
       VALUES ($1, $2, $3, $4, 'pending', $5, $6, $7, $8)
       RETURNING *`,
      [userId, parseInt(social_event_id, 10), parseInt(guests, 10), notes || null, contact_name || null, contact_email || null, contact_phone || null, contact_method || null]
    );
    return NextResponse.json({ data: rows[0] });
  } catch (error: any) {
    console.error('POST /api/social_event_reservations error:', error);
    return NextResponse.json({ error: error.message || 'Failed to create reservation' }, { status: 500 });
  }
}