import { sql } from '@vercel/postgres';
import { withCollectionPermission } from '../../../../lib/permission-middleware';

async function handler(req, res) {
  // Set CORS headers
  res.setHeader('Access-Control-Allow-Origin', '*');
  res.setHeader('Access-Control-Allow-Methods', 'GET, OPTIONS');
  res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization');

  // Handle preflight requests
  if (req.method === 'OPTIONS') {
    res.status(200).end();
    return;
  }

  if (req.method !== 'GET') {
    return res.status(405).json({ error: 'Method not allowed' });
  }

  const { id } = req.query; // collection id

  try {
    // Get activity log for the collection
    const result = await sql`
      SELECT 
        ca.*,
        u.email as user_email
      FROM collection_activity ca
      LEFT JOIN users u ON ca.user_id = u.id
      WHERE ca.collection_id = ${id}
      ORDER BY ca.created_at DESC
      LIMIT 50
    `;

    res.status(200).json(result.rows);

  } catch (error) {
    console.error('Error fetching collection activity:', error);
    res.status(500).json({ error: 'Internal server error' });
  }
}

// Apply permission middleware - requires viewer access to see activity
export default withCollectionPermission('viewer')(handler);