import { NextRequest, NextResponse } from "next/server";
import { sql } from "@/db";
import { requireFamily } from "@/lib/auth";

// PATCH /api/notifications/[id]  — mark a single notification as read
export async function PATCH(
  _req: NextRequest,
  { params }: { params: Promise<{ id: string }> }
) {
  try {
    const auth = await requireFamily();
    if (!auth.success) return NextResponse.json({ error: auth.error }, { status: auth.status });

    const familyId = auth.session!.familyId!;
    const { id }   = await params;

    // Only update rows belonging to this family (security check via family_id)
    await sql`
      UPDATE notifications
      SET is_read = true
      WHERE id = ${id} AND family_id = ${familyId}
    `;

    return NextResponse.json({ success: true });
  } catch (err) {
    console.error("Notification PATCH [id] error:", err);
    return NextResponse.json({ error: String(err) }, { status: 500 });
  }
}
