ok_r/app/api/krs/[id]/route.ts

export const dynamic = 'force-dynamic';

import { NextRequest, NextResponse } from 'next/server';
import { supabase } from '@/lib/supabase';
import { ensureAdmin, ensureAuthenticated, getAuthContext, hasProjectAccess } from '@/lib/access-control';

export async function GET(
  request: NextRequest,
  { params }: { params: { id: string } }
) {
  const ctx = await getAuthContext(request);
  const auth = ensureAuthenticated(ctx);
  if (!auth.ok) {
    return NextResponse.json({ error: auth.error }, { status: auth.status });
  }

  const { data, error } = await supabase
    .from('krs')
    .select(`
      *,
      owner:users!krs_owner_user_id_fkey(id, name, role, avatar_url),
      project:projects(id, name, status),
      objective:objectives(id, title, period_start, period_end)
    `)
    .eq('id', params.id)
    .maybeSingle();

  if (error) {
    return NextResponse.json({ error: error.message }, { status: 500 });
  }

  if (!data) {
    return NextResponse.json({ error: 'KR不存在' }, { status: 404 });
  }

  if (!ctx!.isAdmin && !hasProjectAccess(ctx!, data.project_id)) {
    return NextResponse.json({ error: '无权限' }, { status: 403 });
  }

  return NextResponse.json(data);
}

export async function PATCH(
  request: NextRequest,
  { params }: { params: { id: string } }
) {
  const ctx = await getAuthContext(request);
  const auth = ensureAdmin(ctx);
  if (!auth.ok) {
    return NextResponse.json({ error: auth.error }, { status: auth.status });
  }

  const body = await request.json();
  const {
    title,
    metric_name,
    unit,
    direction,
    target_value,
    current_value,
    confidence,
    status,
    reason_code,
    note,
    need_owner_help,
    period_start,
    period_end,
    period_type,
    period_name,
    objective_id,
  } = body;

  if ((status === 'yellow' || status === 'red') && !reason_code && !body.skipReasonCodeCheck) {
    return NextResponse.json(
      { error: '黄色或红色状态必须提供原因代码' },
      { status: 400 }
    );
  }

  const updateData: Record<string, unknown> = { updated_at: new Date().toISOString() };
  if (title !== undefined) updateData.title = title;
  if (metric_name !== undefined) updateData.metric_name = metric_name;
  if (unit !== undefined) updateData.unit = unit;
  if (direction !== undefined) updateData.direction = direction;
  if (target_value !== undefined) updateData.target_value = target_value;
  if (current_value !== undefined) updateData.current_value = current_value;
  if (confidence !== undefined) updateData.confidence = confidence;
  if (status !== undefined) updateData.status = status;
  if (reason_code !== undefined) updateData.reason_code = reason_code;
  if (note !== undefined) updateData.note = note;
  if (need_owner_help !== undefined) updateData.need_owner_help = need_owner_help;
  if (period_start !== undefined) updateData.period_start = period_start;
  if (period_end !== undefined) updateData.period_end = period_end;
  if (period_type !== undefined) updateData.period_type = period_type;
  if (period_name !== undefined) updateData.period_name = period_name;
  if (objective_id !== undefined) updateData.objective_id = objective_id;

  const { data, error } = await supabase
    .from('krs')
    .update(updateData)
    .eq('id', params.id)
    .select()
    .single();

  if (error) {
    return NextResponse.json({ error: error.message }, { status: 500 });
  }

  return NextResponse.json(data);
}

export async function DELETE(
  request: NextRequest,
  { params }: { params: { id: string } }
) {
  const ctx = await getAuthContext(request);
  const auth = ensureAdmin(ctx);
  if (!auth.ok) {
    return NextResponse.json({ error: auth.error }, { status: auth.status });
  }

  const { error } = await supabase
    .from('krs')
    .delete()
    .eq('id', params.id);

  if (error) {
    return NextResponse.json({ error: error.message }, { status: 500 });
  }

  return NextResponse.json({ success: true });
}