import { NextResponse } from 'next/server'
import { getSessionUser } from '@/lib/auth'
import { canViewPurchase } from '@/lib/data/billing-context'
import { loadPurchase } from '@/lib/data/purchases'

/** Purchase + items + payment reference (task §5.4). Reading never changes status. */
export async function GET(_req: Request, ctx: { params: Promise<{ purchaseId: string }> }) {
  const { purchaseId } = await ctx.params
  const user = await getSessionUser()
  if (!user) return NextResponse.json({ error: 'Sign in first.' }, { status: 401 })
  const bundle = await loadPurchase(purchaseId)
  if (!bundle) return NextResponse.json({ error: 'Purchase not found.' }, { status: 404 })
  if (!(await canViewPurchase(user, bundle.purchase))) return NextResponse.json({ error: 'You cannot view this purchase.' }, { status: 403 })
  return NextResponse.json({ ok: true, purchase: bundle.purchase, items: bundle.items, payment: bundle.payment })
}