import { Request, Response } from "express";
import { isValidObjectId } from "mongoose";
import Order from "../../models/order";
import { UserRole } from "../../types/types";

// Single order details. Only the customer who placed it, the vendor it
// belongs to, or an admin may read it.
const getOrderById = async (req: Request, res: Response) => {
  const { id } = req.params;

  if (!isValidObjectId(id)) {
    return res.status(400).json({ message: "Order ID is not valid" });
  }

  try {
    const order = await Order.findById(id);
    if (!order) {
      return res.status(404).json({ message: "Order not found" });
    }

    const requesterId = String(req.user?._id);
    const isOwner =
      String(order.user?._id ?? order.user) === requesterId ||
      String(order.vendor?._id ?? order.vendor) === requesterId;
    if (!isOwner && req.user?.role !== UserRole.admin) {
      return res.status(403).json({ message: "Not allowed" });
    }

    res.status(200).json(order);
  } catch (err: any) {
    res.status(500).json({ message: err?.message || "Something went wrong" });
  }
};

export { getOrderById };