pfandsystem-demo/backend/routes/artikel.js

import express from 'express';
import fs from 'fs';
import path from 'path';
import { body, validationResult } from 'express-validator';
import pool from '../config/database.js';
import { authenticateToken, requireTenant, requireRole } from '../middleware/auth.js';
import { upload } from '../middleware/upload.js';

const router = express.Router();
router.use(authenticateToken, requireTenant);

// GET alle Artikel (auch Inaktive fuer Admin)
router.get('/', async (req, res) => {
  try {
    const showInactive = req.query.all === '1';
    const where = showInactive ? 'tenant_id = ?' : 'tenant_id = ? AND aktiv = 1';
    const [rows] = await pool.query(
      `SELECT * FROM artikel WHERE ${where} ORDER BY bezeichnung ASC`,
      [req.user.tenant_id]
    );
    res.json(rows);
  } catch (e) { res.status(500).json({ error: 'Serverfehler' }); }
});

router.get('/:id', async (req, res) => {
  try {
    const [rows] = await pool.query(
      'SELECT * FROM artikel WHERE id = ? AND tenant_id = ?',
      [req.params.id, req.user.tenant_id]
    );
    if (rows.length === 0) return res.status(404).json({ error: 'Artikel nicht gefunden' });
    res.json(rows[0]);
  } catch (e) { res.status(500).json({ error: 'Serverfehler' }); }
});

// POST: Anlegen (Admin only)
router.post('/', requireRole(['admin']), [
  body('bezeichnung').notEmpty().trim(),
  body('pfand_betrag').isFloat({ min: 0 }),
  body('beschreibung').optional({ checkFalsy: true }).trim(),
], async (req, res) => {
  const errors = validationResult(req);
  if (!errors.isEmpty()) return res.status(400).json({ errors: errors.array() });
  try {
    await pool.query(
      `INSERT INTO artikel (id, tenant_id, bezeichnung, pfand_betrag, beschreibung, aktiv)
       VALUES (UUID(), ?, ?, ?, ?, 1)`,
      [req.user.tenant_id, req.body.bezeichnung, req.body.pfand_betrag,
       req.body.beschreibung || null]
    );
    const [rows] = await pool.query(
      'SELECT * FROM artikel WHERE tenant_id = ? ORDER BY erstellt_am DESC LIMIT 1',
      [req.user.tenant_id]
    );
    res.status(201).json(rows[0]);
  } catch (e) {
    console.error('POST artikel:', e);
    res.status(500).json({ error: 'Serverfehler' });
  }
});

// PUT: Aendern (Admin only)
router.put('/:id', requireRole(['admin']), [
  body('bezeichnung').notEmpty().trim(),
  body('pfand_betrag').isFloat({ min: 0 }),
  body('beschreibung').optional({ checkFalsy: true }).trim(),
  body('aktiv').optional().isBoolean(),
], async (req, res) => {
  const errors = validationResult(req);
  if (!errors.isEmpty()) return res.status(400).json({ errors: errors.array() });
  try {
    const aktivVal = req.body.aktiv === undefined ? 1 : (req.body.aktiv ? 1 : 0);
    const [r] = await pool.query(
      `UPDATE artikel
         SET bezeichnung=?, pfand_betrag=?, beschreibung=?, aktiv=?
       WHERE id=? AND tenant_id=?`,
      [req.body.bezeichnung, req.body.pfand_betrag, req.body.beschreibung || null,
       aktivVal, req.params.id, req.user.tenant_id]
    );
    if (r.affectedRows === 0) return res.status(404).json({ error: 'Artikel nicht gefunden' });
    const [rows] = await pool.query('SELECT * FROM artikel WHERE id=? AND tenant_id=?',
                                    [req.params.id, req.user.tenant_id]);
    res.json(rows[0]);
  } catch (e) { res.status(500).json({ error: 'Serverfehler' }); }
});

// POST Produktbild (Admin only)
router.post('/:id/bild', requireRole(['admin']), upload.single('foto'), async (req, res) => {
  if (!req.file) return res.status(400).json({ error: 'Kein Bild hochgeladen' });
  try {
    const [[a]] = await pool.query('SELECT bild_url FROM artikel WHERE id=? AND tenant_id=?',
                                   [req.params.id, req.user.tenant_id]);
    if (!a) {
      try { fs.unlinkSync(req.file.path); } catch {}
      return res.status(404).json({ error: 'Artikel nicht gefunden' });
    }
    // Altes Bild loeschen (best effort)
    if (a.bild_url) {
      const oldPath = path.join(process.env.UPLOAD_DIR || '/app/uploads',
                                a.bild_url.replace(/^\/uploads\//, ''));
      try { fs.unlinkSync(oldPath); } catch {}
    }
    const newUrl = `/uploads/${req.file.filename}`;
    await pool.query('UPDATE artikel SET bild_url=? WHERE id=? AND tenant_id=?',
                     [newUrl, req.params.id, req.user.tenant_id]);
    const [rows] = await pool.query('SELECT * FROM artikel WHERE id=? AND tenant_id=?',
                                    [req.params.id, req.user.tenant_id]);
    res.json(rows[0]);
  } catch (e) {
    console.error('POST artikel/bild:', e);
    res.status(500).json({ error: 'Serverfehler' });
  }
});

router.delete('/:id/bild', requireRole(['admin']), async (req, res) => {
  try {
    const [[a]] = await pool.query('SELECT bild_url FROM artikel WHERE id=? AND tenant_id=?',
                                   [req.params.id, req.user.tenant_id]);
    if (!a) return res.status(404).json({ error: 'Artikel nicht gefunden' });
    if (a.bild_url) {
      const p = path.join(process.env.UPLOAD_DIR || '/app/uploads',
                          a.bild_url.replace(/^\/uploads\//, ''));
      try { fs.unlinkSync(p); } catch {}
    }
    await pool.query('UPDATE artikel SET bild_url=NULL WHERE id=? AND tenant_id=?',
                     [req.params.id, req.user.tenant_id]);
    res.json({ message: 'Bild entfernt' });
  } catch (e) { res.status(500).json({ error: 'Serverfehler' }); }
});

router.delete('/:id', requireRole(['admin']), async (req, res) => {
  try {
    // Bild-Datei mitloeschen
    const [[a]] = await pool.query('SELECT bild_url FROM artikel WHERE id=? AND tenant_id=?',
                                   [req.params.id, req.user.tenant_id]);
    if (a?.bild_url) {
      const p = path.join(process.env.UPLOAD_DIR || '/app/uploads',
                          a.bild_url.replace(/^\/uploads\//, ''));
      try { fs.unlinkSync(p); } catch {}
    }
    const [r] = await pool.query('DELETE FROM artikel WHERE id=? AND tenant_id=?',
                                 [req.params.id, req.user.tenant_id]);
    if (r.affectedRows === 0) return res.status(404).json({ error: 'Artikel nicht gefunden' });
    res.json({ message: 'Artikel gelöscht' });
  } catch (e) {
    if (e.code === 'ER_ROW_IS_REFERENCED' || e.code === 'ER_ROW_IS_REFERENCED_2') {
      return res.status(400).json({
        error: 'Artikel wird in Lieferungen/Rücknahmen verwendet — bitte stattdessen auf "Inaktiv" setzen.'
      });
    }
    res.status(500).json({ error: 'Serverfehler' });
  }
});

export default router;