pfandsystem-demo/backend/routes/kunden-bilder.js

import express from 'express';
import fs from 'fs';
import path from 'path';
import pool from '../config/database.js';
import { authenticateToken, requireTenant } from '../middleware/auth.js';
import { upload } from '../middleware/upload.js';

const router = express.Router();
router.use(authenticateToken, requireTenant);

// POST /api/kunden-bilder/:kunde_id  (Multipart, Feld: foto)
router.post('/:kunde_id', upload.single('foto'), async (req, res) => {
  if (!req.file) return res.status(400).json({ error: 'Kein Bild hochgeladen' });
  try {
    const [[k]] = await pool.query('SELECT id FROM kunden WHERE id=? AND tenant_id=?',
                                   [req.params.kunde_id, req.user.tenant_id]);
    if (!k) {
      // Datei aufraeumen
      try { fs.unlinkSync(req.file.path); } catch {}
      return res.status(404).json({ error: 'Kunde nicht gefunden' });
    }
    const [[c]] = await pool.query(
      'SELECT COUNT(*) AS n FROM kunden_bilder WHERE kunde_id = ? AND tenant_id = ?',
      [req.params.kunde_id, req.user.tenant_id]
    );
    if (c.n >= 5) {
      try { fs.unlinkSync(req.file.path); } catch {}
      return res.status(400).json({ error: 'Max. 5 Bilder pro Kunde' });
    }
    await pool.query(
      `INSERT INTO kunden_bilder (id, tenant_id, kunde_id, dateiname, beschreibung, sortierung)
       VALUES (UUID(), ?, ?, ?, ?, ?)`,
      [req.user.tenant_id, req.params.kunde_id, `/uploads/${req.file.filename}`,
       req.body.beschreibung || null, parseInt(req.body.sortierung) || c.n]
    );
    const [rows] = await pool.query(
      `SELECT * FROM kunden_bilder WHERE kunde_id = ? AND tenant_id = ?
       ORDER BY sortierung, erstellt_am`,
      [req.params.kunde_id, req.user.tenant_id]
    );
    res.status(201).json(rows);
  } catch (e) {
    console.error('POST kunden-bilder:', e);
    res.status(500).json({ error: 'Serverfehler' });
  }
});

// PATCH /api/kunden-bilder/:id  -> beschreibung / sortierung
router.patch('/bild/:id', async (req, res) => {
  const updates = [];
  const values = [];
  if (req.body.beschreibung !== undefined) { updates.push('beschreibung = ?'); values.push(req.body.beschreibung); }
  if (req.body.sortierung !== undefined) { updates.push('sortierung = ?'); values.push(parseInt(req.body.sortierung)); }
  if (updates.length === 0) return res.status(400).json({ error: 'Keine Änderungen' });
  values.push(req.params.id, req.user.tenant_id);
  try {
    const [r] = await pool.query(
      `UPDATE kunden_bilder SET ${updates.join(', ')} WHERE id = ? AND tenant_id = ?`,
      values
    );
    if (r.affectedRows === 0) return res.status(404).json({ error: 'Bild nicht gefunden' });
    res.json({ message: 'Aktualisiert' });
  } catch (e) { res.status(500).json({ error: 'Serverfehler' }); }
});

// DELETE /api/kunden-bilder/bild/:id
router.delete('/bild/:id', async (req, res) => {
  try {
    const [rows] = await pool.query(
      'SELECT dateiname FROM kunden_bilder WHERE id = ? AND tenant_id = ?',
      [req.params.id, req.user.tenant_id]
    );
    if (rows.length === 0) return res.status(404).json({ error: 'Bild nicht gefunden' });
    await pool.query('DELETE FROM kunden_bilder WHERE id = ? AND tenant_id = ?',
                     [req.params.id, req.user.tenant_id]);
    // Datei löschen (best effort)
    const filename = rows[0].dateiname.replace(/^\/uploads\//, '');
    const fullPath = path.join(process.env.UPLOAD_DIR || '/app/uploads', filename);
    try { fs.unlinkSync(fullPath); } catch {}
    res.json({ message: 'Bild gelöscht' });
  } catch (e) { res.status(500).json({ error: 'Serverfehler' }); }
});

export default router;