// ALWAYS: Use resource-oriented URLs with consistent naming
// Routes follow: /{resource}/{id}/{sub-resource}/{id}
 
// api/routes/orders.ts
import { Hono } from "hono";
import { z } from "zod";
import { zValidator } from "@hono/zod-validator";
 
const ordersRouter = new Hono();
 
// GET /orders -- List with pagination, filtering, sorting
ordersRouter.get(
  "/",
  zValidator("query", z.object({
    cursor: z.string().optional(),
    limit: z.coerce.number().min(1).max(100).default(20),
    status: z.enum(["pending", "confirmed", "shipped", "delivered"]).optional(),
    sort: z.enum(["createdAt", "totalAmount"]).default("createdAt"),
    order: z.enum(["asc", "desc"]).default("desc"),
  })),
  async (c) => {
    const query = c.req.valid("query");
    const { items, nextCursor } = await orderService.list(query);
 
    return c.json({
      data: items,
      pagination: {
        nextCursor,
        hasMore: nextCursor !== null,
      },
    });
  },
);
 
// POST /orders -- Create a new order
ordersRouter.post(
  "/",
  zValidator("json", CreateOrderSchema),
  async (c) => {
    const input = c.req.valid("json");
    const order = await orderService.create(input);
 
    return c.json({ data: order }, 201, {
      Location: `/api/v1/orders/${order.id}`,
    });
  },
);
 
// GET /orders/:id -- Get single order
ordersRouter.get("/:id", async (c) => {
  const order = await orderService.getById(c.req.param("id"));
 
  if (!order) {
    return c.json({
      error: {
        code: "ORDER_NOT_FOUND",
        message: "Order not found",
        status: 404,
      },
    }, 404);
  }
 
  return c.json({ data: order });
});

// ALWAYS: Use consistent error response format across all endpoints
// errors/api-error.ts
 
interface ApiErrorResponse {
  error: {
    code: string;          // Machine-readable error code
    message: string;       // Human-readable message
    status: number;        // HTTP status code
    details?: unknown[];   // Validation errors or additional context
    requestId: string;     // For support/debugging
  };
}
 
class ApiError extends Error {
  constructor(
    public readonly code: string,
    public readonly status: number,
    message: string,
    public readonly details?: unknown[],
  ) {
    super(message);
  }
 
  static badRequest(code: string, message: string, details?: unknown[]) {
    return new ApiError(code, 400, message, details);
  }
 
  static notFound(resource: string, id: string) {
    return new ApiError(
      `${resource.toUpperCase()}_NOT_FOUND`,
      404,
      `${resource} with id '${id}' not found`,
    );
  }
 
  static conflict(code: string, message: string) {
    return new ApiError(code, 409, message);
  }
}
 
// Global error handler middleware
export function errorHandler(err: Error, c: Context): Response {
  const requestId = c.get("requestId");
 
  if (err instanceof ApiError) {
    return c.json({
      error: {
        code: err.code,
        message: err.message,
        status: err.status,
        details: err.details,
        requestId,
      },
    }, err.status as StatusCode);
  }
 
  // Unexpected errors
  console.error("Unhandled error:", err);
  return c.json({
    error: {
      code: "INTERNAL_ERROR",
      message: "An unexpected error occurred",
      status: 500,
      requestId,
    },
  }, 500);
}

// ALWAYS: Organize tRPC routers by domain with shared middleware
import { initTRPC, TRPCError } from "@trpc/server";
import { z } from "zod";
import type { Context } from "./context";
 
const t = initTRPC.context<Context>().create();
 
const isAuthenticated = t.middleware(async ({ ctx, next }) => {
  if (!ctx.session) {
    throw new TRPCError({ code: "UNAUTHORIZED" });
  }
  return next({ ctx: { ...ctx, session: ctx.session } });
});
 
const protectedProcedure = t.procedure.use(isAuthenticated);
 
export const orderRouter = t.router({
  list: protectedProcedure
    .input(z.object({
      cursor: z.string().optional(),
      limit: z.number().min(1).max(100).default(20),
      status: z.enum(["pending", "confirmed", "shipped"]).optional(),
    }))
    .query(async ({ ctx, input }) => {
      return ctx.orderService.list(input);
    }),
 
  create: protectedProcedure
    .input(CreateOrderSchema)
    .mutation(async ({ ctx, input }) => {
      return ctx.orderService.create(ctx.session.userId, input);
    }),
 
  byId: protectedProcedure
    .input(z.object({ id: z.string().uuid() }))
    .query(async ({ ctx, input }) => {
      const order = await ctx.orderService.getById(input.id);
      if (!order) {
        throw new TRPCError({ code: "NOT_FOUND", message: "Order not found" });
      }
      return order;
    }),
});

// ALWAYS: Implement tiered rate limiting with proper headers
import { Ratelimit } from "@upstash/ratelimit";
import { Redis } from "@upstash/redis";
 
const redis = new Redis({ url: process.env.REDIS_URL!, token: process.env.REDIS_TOKEN! });
 
const rateLimiters = {
  standard: new Ratelimit({
    redis,
    limiter: Ratelimit.slidingWindow(100, "60 s"),
    prefix: "rl:standard",
  }),
  premium: new Ratelimit({
    redis,
    limiter: Ratelimit.slidingWindow(1000, "60 s"),
    prefix: "rl:premium",
  }),
};
 
export async function rateLimitMiddleware(c: Context, next: Next) {
  const apiKey = c.req.header("x-api-key");
  const tier = await getApiKeyTier(apiKey);
  const limiter = rateLimiters[tier];
 
  const { success, limit, remaining, reset } = await limiter.limit(apiKey!);
 
  c.header("X-RateLimit-Limit", limit.toString());
  c.header("X-RateLimit-Remaining", remaining.toString());
  c.header("X-RateLimit-Reset", reset.toString());
 
  if (!success) {
    c.header("Retry-After", Math.ceil((reset - Date.now()) / 1000).toString());
    return c.json({
      error: {
        code: "RATE_LIMIT_EXCEEDED",
        message: "Too many requests",
        status: 429,
      },
    }, 429);
  }
 
  return next();
}

// ALWAYS: Prefer cursor-based over offset-based pagination for stability
interface PaginatedResponse<T> {
  data: T[];
  pagination: {
    nextCursor: string | null;
    hasMore: boolean;
  };
}
 
async function listOrders(params: {
  cursor?: string;
  limit: number;
  status?: string;
}): Promise<PaginatedResponse<Order>> {
  const { cursor, limit, status } = params;
 
  const where: SQL[] = [];
  if (status) where.push(eq(orders.status, status));
  if (cursor) where.push(lt(orders.id, cursor));
 
  const items = await db
    .select()
    .from(orders)
    .where(and(...where))
    .orderBy(desc(orders.createdAt))
    .limit(limit + 1); // Fetch one extra to check hasMore
 
  const hasMore = items.length > limit;
  const data = hasMore ? items.slice(0, limit) : items;
  const nextCursor = hasMore ? data[data.length - 1].id : null;
 
  return { data, pagination: { nextCursor, hasMore } };
}