const express = require('express');
const authenticate = require('../middleware/auth');
const Block = require('../models/Block');

const router = express.Router();

// Public blocks (no auth for listing)
router.get('/', async (req, res) => {
  try {
    const blocks = await Block.findAll({
      where: { is_public: true },
      attributes: ['id', 'name', 'svg_data', 'category'],
    });
    res.json(blocks);
  } catch (err) {
    console.error(err);
    res.status(500).json({ error: 'Failed to list blocks' });
  }
});

// Protected: create a new block (requires auth)
router.post('/', authenticate, async (req, res) => {
  try {
    const { name, svg_data, category, is_public } = req.body;
    if (!name || !svg_data) {
      return res.status(400).json({ error: 'Name and svg_data required' });
    }
    const block = await Block.create({
      name,
      svg_data,
      category: category || 'Allgemein',
      is_public: is_public !== undefined ? is_public : true,
      userId: req.user.id,
    });
    res.status(201).json(block);
  } catch (err) {
    console.error(err);
    res.status(500).json({ error: 'Failed to create block' });
  }
});

// Protected: delete block (only owner)
router.delete('/:id', authenticate, async (req, res) => {
  try {
    const block = await Block.findOne({
      where: { id: req.params.id, userId: req.user.id },
    });
    if (!block) {
      return res.status(404).json({ error: 'Block not found or not authorized' });
    }
    await block.destroy();
    res.json({ message: 'Block deleted' });
  } catch (err) {
    console.error(err);
    res.status(500).json({ error: 'Failed to delete block' });
  }
});

module.exports = router;