import { NextRequest, NextResponse } from "next/server";
import { requireSuperAdminAuth } from "@/lib/staff-auth";
import { prisma } from "@/lib/db";

export async function POST(request: NextRequest) {
  try {
    const currentUser = await requireSuperAdminAuth();
    if (!currentUser) {
      return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
    }

    const body = await request.json();
    const { staffId, isActive } = body;

    if (!staffId) {
      return NextResponse.json({ error: "Staff ID required" }, { status: 400 });
    }

    // Prevent self-deactivation
    if (staffId === currentUser.id) {
      return NextResponse.json(
        { error: "Cannot deactivate your own account" },
        { status: 400 },
      );
    }

    // Update staff status
    const updatedStaff = await prisma.users.update({
      where: { id: staffId },
      data: { isActive },
    });

    // Log action

    return NextResponse.json({ success: true });
  } catch (error) {
    console.error("Failed to toggle staff status:", error);
    return NextResponse.json(
      { error: "Failed to update staff status" },
      { status: 500 },
    );
  }
}
