/**
 * POST /api/webhooks
 * Create a webhook
 */
import { query } from '../../utils/database'

interface CreateWebhookBody {
  name: string
  url: string
  secret?: string
  events: string[]
  instanceId?: string | null
}

export default defineEventHandler(async (event) => {
  const username = getHeader(event, 'x-authentik-username')
  if (!username) {
    throw createError({ statusCode: 401, message: 'Unauthorized' })
  }

  const body = await readBody<CreateWebhookBody>(event)

  if (!body.name?.trim()) {
    throw createError({ statusCode: 400, message: 'Name is required' })
  }
  if (!body.url?.trim()) {
    throw createError({ statusCode: 400, message: 'URL is required' })
  }
  if (!body.events?.length) {
    throw createError({ statusCode: 400, message: 'At least one event is required' })
  }

  const result = await query<{ id: string }>(
    `INSERT INTO webhooks (name, url, secret, events, instance_id, created_by)
     VALUES ($1, $2, $3, $4, $5, $6)
     RETURNING id`,
    [
      body.name.trim(),
      body.url.trim(),
      body.secret || null,
      body.events,
      body.instanceId || null,
      username
    ]
  )

  return {
    id: result.rows[0].id,
    name: body.name,
    url: body.url,
    events: body.events,
    instanceId: body.instanceId || null
  }
})