import { NextRequest, NextResponse } from "next/server";
import { prisma } from "@/lib/prisma";
import { requireAuth, getScopedEstablishmentId, forbidden } from "@/lib/api-auth";

export async function GET(req: NextRequest) {
  const user = await requireAuth();
  if (user instanceof NextResponse) return user;

  const { searchParams } = new URL(req.url);
  const requestedId = searchParams.get("establishmentId");
  const establishmentId = getScopedEstablishmentId(user, requestedId);
  if (establishmentId instanceof NextResponse) return establishmentId;

  let where: any = {};
  if (establishmentId) {
    const classes = await prisma.class.findMany({ where: { establishmentId }, select: { id: true } });
    const students = await prisma.student.findMany({ where: { classId: { in: classes.map((c) => c.id) } }, select: { id: true } });
    where.studentId = { in: students.map((s) => s.id) };
  }

  const nodes = await prisma.node.findMany({
    where,
    include: { student: { include: { class: true } }, instances: true },
    orderBy: { lastSeen: "desc" },
  });
  return NextResponse.json(nodes);
}