pfandsystem-demo/backend/routes/geraete.js

import express from 'express';
import { body, validationResult } from 'express-validator';
import pool from '../config/database.js';
import { authenticateToken, requireTenant } from '../middleware/auth.js';

const router = express.Router();
router.use(authenticateToken, requireTenant);

router.get('/', async (req, res) => {
  try {
    const [rows] = await pool.query(
      `SELECT g.*, k.name AS kunde_name
       FROM geraete g
       LEFT JOIN kunden k ON g.kunde_id = k.id
       WHERE g.tenant_id = ?
       ORDER BY g.typ, g.seriennummer`,
      [req.user.tenant_id]
    );
    res.json(rows);
  } catch (e) { res.status(500).json({ error: 'Serverfehler' }); }
});

router.get('/:id', async (req, res) => {
  try {
    const [rows] = await pool.query(
      `SELECT g.*, k.name AS kunde_name FROM geraete g
       LEFT JOIN kunden k ON g.kunde_id = k.id
       WHERE g.id = ? AND g.tenant_id = ?`,
      [req.params.id, req.user.tenant_id]
    );
    if (rows.length === 0) return res.status(404).json({ error: 'Geraet nicht gefunden' });
    res.json(rows[0]);
  } catch (e) { res.status(500).json({ error: 'Serverfehler' }); }
});

router.post('/', [
  body('seriennummer').notEmpty().trim(),
  body('typ').notEmpty().trim(),
  body('bezeichnung').optional({ checkFalsy: true }).trim(),
  body('kunde_id').optional({ checkFalsy: true }),
  body('status').optional().isIn(['aktiv', 'in_reparatur', 'ausgemustert', 'lager']),
  body('notiz').optional({ checkFalsy: true }).trim()
], async (req, res) => {
  const errors = validationResult(req);
  if (!errors.isEmpty()) return res.status(400).json({ errors: errors.array() });
  const { seriennummer, typ, bezeichnung, kunde_id, status, notiz } = req.body;
  try {
    if (kunde_id) {
      const [[k]] = await pool.query('SELECT id FROM kunden WHERE id=? AND tenant_id=?',
                                     [kunde_id, req.user.tenant_id]);
      if (!k) return res.status(400).json({ error: 'Kunde nicht im Tenant' });
    }
    await pool.query(
      `INSERT INTO geraete (id, tenant_id, seriennummer, typ, bezeichnung, kunde_id, status, notiz)
       VALUES (UUID(), ?, ?, ?, ?, ?, ?, ?)`,
      [req.user.tenant_id, seriennummer, typ, bezeichnung || null,
       kunde_id || null, status || 'aktiv', notiz || null]
    );
    const [rows] = await pool.query(
      'SELECT * FROM geraete WHERE tenant_id = ? AND seriennummer = ?',
      [req.user.tenant_id, seriennummer]
    );
    res.status(201).json(rows[0]);
  } catch (e) {
    if (e.code === 'ER_DUP_ENTRY') return res.status(400).json({ error: 'Seriennummer bereits vergeben' });
    console.error('POST geraete:', e);
    res.status(500).json({ error: 'Serverfehler' });
  }
});

router.put('/:id', [
  body('seriennummer').notEmpty().trim(),
  body('typ').notEmpty().trim(),
  body('status').optional().isIn(['aktiv', 'in_reparatur', 'ausgemustert', 'lager'])
], async (req, res) => {
  const errors = validationResult(req);
  if (!errors.isEmpty()) return res.status(400).json({ errors: errors.array() });
  const { seriennummer, typ, bezeichnung, kunde_id, status, notiz } = req.body;
  try {
    if (kunde_id) {
      const [[k]] = await pool.query('SELECT id FROM kunden WHERE id=? AND tenant_id=?',
                                     [kunde_id, req.user.tenant_id]);
      if (!k) return res.status(400).json({ error: 'Kunde nicht im Tenant' });
    }
    const [r] = await pool.query(
      `UPDATE geraete SET seriennummer=?, typ=?, bezeichnung=?, kunde_id=?, status=?, notiz=?
       WHERE id=? AND tenant_id=?`,
      [seriennummer, typ, bezeichnung || null, kunde_id || null,
       status || 'aktiv', notiz || null, req.params.id, req.user.tenant_id]
    );
    if (r.affectedRows === 0) return res.status(404).json({ error: 'Geraet nicht gefunden' });
    const [rows] = await pool.query('SELECT * FROM geraete WHERE id=? AND tenant_id=?',
                                    [req.params.id, req.user.tenant_id]);
    res.json(rows[0]);
  } catch (e) {
    if (e.code === 'ER_DUP_ENTRY') return res.status(400).json({ error: 'Seriennummer bereits vergeben' });
    res.status(500).json({ error: 'Serverfehler' });
  }
});

router.delete('/:id', async (req, res) => {
  try {
    const [r] = await pool.query('DELETE FROM geraete WHERE id=? AND tenant_id=?',
                                 [req.params.id, req.user.tenant_id]);
    if (r.affectedRows === 0) return res.status(404).json({ error: 'Geraet nicht gefunden' });
    res.json({ message: 'Geraet geloescht' });
  } catch (e) { res.status(500).json({ error: 'Serverfehler' }); }
});

export default router;