"use strict";
const { Router } = require("express");
const { query, insert, update } = require("../db");
const { getSession } = require("../auth");
const router = Router();

router.get("/disciplinary", async (req, res) => {
  const session = getSession(req);
  if (!session || (session.role !== "admin" && session.role !== "teacher")) return res.status(403).json({ error: "Staff only" });
  const { studentId, classId, severity, status } = req.query;
  let sql = `SELECT d.*, CONCAT(s.first_name,' ',s.last_name) as student_name, c.name as class_name
    FROM disciplinary_records d
    LEFT JOIN students s ON d.student_id=s.id
    LEFT JOIN classes c ON d.class_id=c.id WHERE 1=1`;
  const params = [];
  if (studentId) { sql += " AND d.student_id=?"; params.push(studentId); }
  if (classId) { sql += " AND d.class_id=?"; params.push(classId); }
  if (severity) { sql += " AND d.severity=?"; params.push(severity); }
  if (status) { sql += " AND d.status=?"; params.push(status); }
  sql += " ORDER BY d.created_at DESC";
  res.json(await query(sql, params));
});

router.get("/disciplinary/student/:studentId", async (req, res) => {
  const session = getSession(req);
  if (!session) return res.status(401).json({ error: "Login required" });
  const sql = `SELECT d.*, CONCAT(s.first_name,' ',s.last_name) as student_name, c.name as class_name
    FROM disciplinary_records d
    LEFT JOIN students s ON d.student_id=s.id
    LEFT JOIN classes c ON d.class_id=c.id
    WHERE d.student_id=? ORDER BY d.created_at DESC`;
  res.json(await query(sql, [req.params.studentId]));
});

router.post("/disciplinary", async (req, res) => {
  const session = getSession(req);
  if (!session || (session.role !== "admin" && session.role !== "teacher")) return res.status(403).json({ error: "Staff only" });
  const { studentId, classId, incident, severity, action, date, notes } = req.body;
  if (!studentId || !classId || !incident || !date) return res.status(400).json({ error: "Required fields missing" });
  const id = await insert("INSERT INTO disciplinary_records (student_id, class_id, incident, severity, action, date, notes, reported_by) VALUES (?,?,?,?,?,?,?,?)",
    [studentId, classId, incident, severity || "minor", action || "", date, notes || "", session.displayName]);
  res.json({ id });
});

router.patch("/disciplinary/:id/resolve", async (req, res) => {
  const session = getSession(req);
  if (!session || session.role !== "admin") return res.status(403).json({ error: "Admin only" });
  const { action, notes } = req.body;
  await update("UPDATE disciplinary_records SET status='resolved', resolved_at=NOW(), action=?, notes=? WHERE id=?",
    [action || "", notes || "", req.params.id]);
  res.json({ resolved: true });
});

router.delete("/disciplinary/:id", async (req, res) => {
  const session = getSession(req);
  if (!session || session.role !== "admin") return res.status(403).json({ error: "Admin only" });
  await query("DELETE FROM disciplinary_records WHERE id=?", [req.params.id]);
  res.json({ deleted: true });
});

module.exports = router;
