const express = require('express');
const db      = require('../../db');
const { authenticate } = require('../../middleware/auth');
const router  = express.Router();

router.get('/', authenticate, (req, res) => {
  res.json(db.prepare('SELECT * FROM qr_codes WHERE user_id=? ORDER BY created_at DESC').all(req.user.id));
});

router.post('/', authenticate, (req, res) => {
  const uid = req.user.id;
  const { label='', url, size=256, fg_color='#000000', bg_color='#ffffff', margin=4,
          dot_style='square', corner_style='square', caption='', caption_pos='bottom',
          caption_color='#000000', caption_size=14 } = req.body;
  if (!url?.trim()) return res.status(400).json({ error: 'URL erforderlich' });
  const r = db.prepare(`
    INSERT INTO qr_codes (user_id,label,url,size,fg_color,bg_color,margin,dot_style,corner_style,caption,caption_pos,caption_color,caption_size,created_at)
    VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,datetime('now','localtime'))
  `).run(uid, label.trim(), url.trim(), size, fg_color, bg_color, margin, dot_style, corner_style, caption.trim(), caption_pos, caption_color, caption_size);
  res.json(db.prepare('SELECT * FROM qr_codes WHERE id=?').get(r.lastInsertRowid));
});

router.put('/:id', authenticate, (req, res) => {
  const qr = db.prepare('SELECT * FROM qr_codes WHERE id=? AND user_id=?').get(req.params.id, req.user.id);
  if (!qr) return res.status(404).json({ error: 'Nicht gefunden' });
  const fields = ['label','url','size','fg_color','bg_color','margin','dot_style','corner_style','caption','caption_pos','caption_color','caption_size'];
  const updates = {};
  fields.forEach(f => { if (req.body[f] !== undefined) updates[f] = req.body[f]; });
  if (!Object.keys(updates).length) return res.json(qr);
  const sets = Object.keys(updates).map(f=>`${f}=?`).join(',');
  db.prepare(`UPDATE qr_codes SET ${sets} WHERE id=?`).run(...Object.values(updates), qr.id);
  res.json(db.prepare('SELECT * FROM qr_codes WHERE id=?').get(qr.id));
});

router.delete('/:id', authenticate, (req, res) => {
  const r = db.prepare('DELETE FROM qr_codes WHERE id=? AND user_id=?').run(req.params.id, req.user.id);
  if (!r.changes) return res.status(404).json({ error: 'Nicht gefunden' });
  res.json({ ok: true });
});

module.exports = router;