import { type NextRequest, NextResponse } from "next/server";
import { auth } from "@/app/(auth)/auth";
import { getSystemSetting } from "@/lib/db/queries";

export async function GET(request: NextRequest) {
  const session = await auth();

  if (!session?.user?.id || !session.user.email) {
    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
  }

  const outTradeNo = request.nextUrl.searchParams.get("outTradeNo");

  if (!outTradeNo) {
    return NextResponse.json({ error: "Missing outTradeNo" }, { status: 400 });
  }

  const setting = await getSystemSetting({ key: `wechat:pay:order:${outTradeNo}` });

  if (!setting || !setting.value || typeof setting.value !== "object") {
    return NextResponse.json({ error: "Order not found" }, { status: 404 });
  }

  const value = setting.value as Record<string, unknown>;
  const userId = typeof value.userId === "string" ? value.userId : null;
  const email = typeof value.email === "string" ? value.email : null;

  if (userId !== session.user.id && email?.toLowerCase() !== session.user.email.toLowerCase()) {
    return NextResponse.json({ error: "Forbidden" }, { status: 403 });
  }

  return NextResponse.json({
    outTradeNo,
    status: typeof value.status === "string" ? value.status : "unknown",
    planId: typeof value.planId === "string" ? value.planId : null,
    transactionId: typeof value.transactionId === "string" ? value.transactionId : null,
    paidAt: typeof value.paidAt === "string" ? value.paidAt : null,
    detail: typeof value.detail === "string" ? value.detail : null,
  });
}