module Api
  # Server documents. Listing and creating need an account; reading and
  # writing a single document also work with just a share link token.
  class DocumentsController < BaseController
    before_action :require_authentication, only: %i[index create]
    before_action :load_document, except: %i[index create]

    # GET /api/documents -- owned + shared with me
    def index
      user = Current.user
      memberships = user.document_memberships.index_by(&:document_id)
      docs = user.accessible_documents.includes(:owner, :updated_by).order(content_updated_at: :desc)
      render json: {
        documents: docs.map { |d| d.meta_json(role: d.owner_id == user.id ? :owner : memberships[d.id]&.role) }
      }
    end

    # POST /api/documents { title, content } -- also used to upload a local document
    def create
      doc = Current.user.owned_documents.create!(
        title: params.require(:title), content: content_param, updated_by: Current.user
      )
      render json: { document: doc.meta_json(role: :owner) }, status: :created
    end

    # GET /api/documents/:id[?known_version=n]
    # With known_version: just the metadata when nothing changed since.
    def show
      touch_membership
      meta = @doc.meta_json(role: @role).merge(lock: @doc.lock_info(lock_holder))
      if params[:known_version].present? && params[:known_version].to_i == @doc.version
        render json: { document: meta, unchanged: true }
      else
        render json: { document: meta.merge(content: @doc.content) }
      end
    end

    # PATCH /api/documents/:id { title } and/or { content, base_version }
    def update
      return forbidden unless Document.role_at_least?(@role, :editor)
      if params.key?(:content)
        return render(json: { error: "locked", holder_name: @doc.lock_holder_name }, status: :locked) if @doc.locked_by_other?(lock_holder)
        @doc.with_lock do
          if params.require(:base_version).to_i != @doc.version
            return render(json: { error: "conflict", version: @doc.version }, status: :conflict)
          end
          @doc.update!(content: content_param, version: @doc.version + 1,
                       content_updated_at: Time.current, updated_by: Current.user)
        end
      end
      @doc.update!(title: params[:title]) if params[:title].present?
      render json: { document: @doc.meta_json(role: @role) }
    end

    # DELETE /api/documents/:id -- the owner deletes it; anyone else leaves it
    def destroy
      if @role == :owner
        @doc.destroy!
      elsif Current.user
        @doc.document_memberships.where(user: Current.user).delete_all
      else
        return forbidden
      end
      head :no_content
    end

    private

    def load_document
      @doc = Document.find(params[:id])
      @role = @doc.role_for(user: Current.user, token: share_token)
      raise ActiveRecord::RecordNotFound unless @role # 404, not 403: don't confirm it exists
    end

    def content_param
      c = params.require(:content)
      c.is_a?(String) ? c : c.to_unsafe_h.to_json
    end

    def touch_membership
      return unless Current.user
      @doc.document_memberships.where(user: Current.user).update_all(last_opened_at: Time.current)
    end

    def forbidden = render(json: { error: "forbidden" }, status: :forbidden)
  end
end