import { NextResponse } from 'next/server';
import { eq } from 'drizzle-orm';

import { withAuth, withPermission } from '@/lib/api/helpers';
import { db } from '@/lib/db';
import { userPortRoles, userProfiles } from '@/lib/db/schema';
import { errorResponse } from '@/lib/errors';

// Sole consumer is the reminder-form's "assign to" picker, so gate on
// `reminders.assign_others` rather than letting any authed user
// enumerate every colleague's display name + user id at the port
// (auditor-A3 §6).
export const GET = withAuth(
  withPermission('reminders', 'assign_others', async (_req, ctx) => {
    try {
      const rows = await db
        .select({
          id: userPortRoles.userId,
          displayName: userProfiles.displayName,
        })
        .from(userPortRoles)
        .innerJoin(userProfiles, eq(userPortRoles.userId, userProfiles.userId))
        .where(eq(userPortRoles.portId, ctx.portId))
        .orderBy(userProfiles.displayName);

      return NextResponse.json({ data: rows });
    } catch (error) {
      return errorResponse(error);
    }
  }),
);
