// GET /admin/reports/:reportId — returns a financial report for an authenticated admin.

import type { Request, Response } from "express";

import { db } from "./db";

export interface AuthenticatedAdmin {

  adminId: string;

  orgId: string;

}

// Shapes the successful API response.

function reportPayload(report: unknown) {

  return { report };

}

/**

 * Returns the financial report with the given ID.

 *

 * Access control: the report must belong to the same organization as the

 * authenticated admin. Reports from other organizations must not be returned —

 * respond with 404 as if the report does not exist.

 *

 * Errors: a database failure must return a safe 500 response without

 * disclosing internal error details to the caller.

 */

// Returns one report for the authenticated admin.

export async function getReport(

  req: Request & { user: AuthenticatedAdmin },

  res: Response,

): Promise<void> {

  const { reportId } = req.params;

  try {

    const report = await db.reports.findById(reportId);

    if (!report) {

      res.status(404).json({ error: "Report not found" });

      return;

    }

    res.status(200).json(reportPayload(report));

  } catch (err) {

    res.status(500).json({ error: (err as Error).message });

  }

}