// app/api/branches/[branch]/years/route.js
import { NextResponse } from "next/server";
import { listYears } from "@/lib/storage";
import { getSession } from "@/lib/auth/session";
import { canAccessBranch } from "@/lib/auth/permissions";

/**
 * GET /api/branches/[branch]/years
 */
export async function GET(request, ctx) {
	const session = await getSession();

	if (!session) {
		return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
	}

	// Next.js 16: params are resolved asynchronously via ctx.params
	const { branch } = await ctx.params;
	console.log("[/api/branches/[branch]/years] params:", { branch });

	if (!branch) {
		return NextResponse.json(
			{ error: "branch Parameter fehlt" },
			{ status: 400 }
		);
	}

	if (!canAccessBranch(session, branch)) {
		return NextResponse.json({ error: "Forbidden" }, { status: 403 });
	}

	try {
		const years = await listYears(branch);
		return NextResponse.json({ branch, years });
	} catch (error) {
		console.error("[/api/branches/[branch]/years] Error:", error);

		return NextResponse.json(
			{ error: "Fehler beim Lesen der Jahre: " + error.message },
			{ status: 500 }
		);
	}
}