import { NextResponse } from 'next/server';
import { getQuestSession, getActiveCompany, requirePermission } from '@/lib/permissions';
import { cancelRequest } from '@/services/alloc-requests';

/**
 * POST: Cancel an allocation request
 */
export async function POST(
  _request: Request,
  { params }: { params: Promise<{ id: string }> }
) {
  const session = await getQuestSession();
  const activeCompany = await getActiveCompany();

  if (!session || !activeCompany) {
    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
  }

  try {
    // Note: using cancel_shipment_request permission for now
    // If a separate cancel_allocation_request permission is needed, add it later
    await requirePermission('cancel_shipment_request');
  } catch {
    return NextResponse.json({ error: 'Forbidden' }, { status: 403 });
  }

  try {
    const { id } = await params;
    const cancelled = await cancelRequest(id, activeCompany.id, session.user.id);
    return NextResponse.json(cancelled);
  } catch (error) {
    console.error('Error cancelling allocation request:', error);
    const message = error instanceof Error ? error.message : 'Internal server error';
    return NextResponse.json({ error: message }, { status: 500 });
  }
}