import { NextRequest, NextResponse } from 'next/server'
import { getSessionUser, unauthorized, forbidden } from '@/lib/sessionUser'
import { prisma } from '@/lib/prisma'

export async function POST(req: NextRequest, { params }: { params: { id: string } }) {
  const u = await getSessionUser()
  if (!u) return unauthorized()
  if (!u.canEdit) return forbidden()

  const activityId = parseInt(params.id)
  const { name, url, size } = await req.json()

  const doc = await prisma.activityDocument.create({
    data: { activityId, name, url, size: size ?? null, uploadedById: u.userId },
  })

  return NextResponse.json(doc, { status: 201 })
}