import { sql } from '@vercel/postgres';

export default async function handler(req, res) {
  // Set CORS headers
  res.setHeader('Access-Control-Allow-Origin', '*');
  res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
  res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization');

  // Handle preflight requests
  if (req.method === 'OPTIONS') {
    res.status(200).end();
    return;
  }

  if (req.method !== 'POST') {
    return res.status(405).json({ error: 'Method not allowed' });
  }

  try {
    const { token } = req.body;

    if (!token) {
      return res.status(400).json({ error: 'Invitation token is required' });
    }

    // Find the invitation
    const invitationResult = await sql`
      SELECT cp.*, c.name as collection_name
      FROM collection_permissions cp
      JOIN collections c ON cp.collection_id = c.id
      WHERE cp.invite_token = ${token} AND cp.status = 'pending'
    `;

    if (invitationResult.rows.length === 0) {
      return res.status(404).json({ error: 'Invalid or expired invitation' });
    }

    const invitation = invitationResult.rows[0];

    // Decline the invitation by deleting the permission record
    await sql`
      DELETE FROM collection_permissions 
      WHERE invite_token = ${token}
    `;

    // Log activity
    await sql`
      INSERT INTO collection_activity (collection_id, user_id, action, details)
      VALUES (${invitation.collection_id}, ${invitation.user_id}, 'invitation_declined', ${JSON.stringify({ token })})
    `;

    res.status(200).json({
      message: 'Invitation declined successfully',
      collection: {
        id: invitation.collection_id,
        name: invitation.collection_name
      }
    });

  } catch (error) {
    console.error('Error declining invitation:', error);
    res.status(500).json({ error: 'Internal server error' });
  }
}