Data Layer: DAL, DTO, Policy, and Actions Pattern

// data/site/site.dto.ts
import { z } from "zod";

export const siteSchema = z.object({
  id: z.uuid(),
  type: siteTypeSchema,
  name: z.string(),
  description: z.string().nullable(),
  address: z.string().nullable(),
  longitude: z.number(),
  latitude: z.number(),
  neighborhood: z.string().nullable(),
  status: siteStatusSchema,
  schedule: z.string().nullable(),
  whatsapp: z.string().nullable(),
  confirmedCount: z.number().int().min(0),
  // offset: true is required — PostgREST emits "+00:00", not "Z"
  confirmedAt: z.iso.datetime({ offset: true }),
  expiresAt: z.iso.datetime({ offset: true }),
  items: z.array(siteItemSchema),
  published: z.boolean(),
});

export type SiteDTO = z.infer<typeof siteSchema>;

const OUT_OF_AREA = "Este mapa solo cubre Manizales y Villamaría.";

export const createSiteSchema = z.object({
  type: siteTypeSchema,
  name: z.string().trim().min(3, "Escribe un nombre reconocible").max(120),
  description: z.string().trim().max(1000).optional(),
  address: z
    .string()
    .trim()
    .min(5, "Escribe la cuadra, la esquina o un punto de referencia")
    .max(200),
  longitude: z.number().min(-76.2, OUT_OF_AREA).max(-74.8, OUT_OF_AREA),
  latitude: z.number().min(4.6, OUT_OF_AREA).max(5.6, OUT_OF_AREA),
  schedule: z.string().trim().max(120).optional(),
  whatsapp: z
    .string()
    .trim()
    .regex(/^\d{10,15}$/, "Debe ser solo dígitos, con indicativo del país")
    .optional(),
});

export type CreateSiteInput = z.infer<typeof createSiteSchema>;

// data/site/site.policy.ts
import type { CurrentUser } from "@/data/user/require-user";

/** Anyone may propose a site. Curation, not registration, is the gate. */
export function canProposeSite(): boolean {
  return true;
}

/** Only a curator makes something visible to the city. */
export function canPublishSite(user: CurrentUser | null): boolean {
  return user?.role === "curator";
}

/**
 * Anyone at all can say a site is still open, or full, or closed — no account.
 * Requiring a session here had the incentive backwards: the person standing
 * in front of the closed shelter is the least likely to have signed in, and
 * they are the only one who actually knows.
 */
export function canConfirmSite(): boolean {
  return true;
}

/**
 * Correcting a site's own fields — type, name, address, hours, phone.
 * Anyone, with no account.
 */
export function canEditSite(): boolean {
  return true;
}

/** Hiding or deleting a site outright — curators only. */
export function canManageSite(user: CurrentUser | null): boolean {
  return user?.role === "curator";
}

// data/site/site.dal.ts
import "server-only";

import { createAdminSupabase } from "@/lib/supabase/admin";
import { createServerSupabase } from "@/lib/supabase/server";

export class SiteDAL {
  private constructor(private readonly user: CurrentUser | null) {}

  /** Authenticated context, for anything that writes. */
  static async create(): Promise<SiteDAL> {
    return new SiteDAL(await getCurrentUser());
  }

  /** Read-only context for genuinely public data: the map anyone can open. */
  static public(): SiteDAL {
    return new SiteDAL(null);
  }

  async listPublished(): Promise<SiteDTO[]> {
    const supabase = await createServerSupabase();
    // ...reads through the session-bound client so RLS applies
  }

  async propose(input: unknown): Promise<{ id: string }> {
    // 1. validate input
    const data = createSiteSchema.parse(input);
    // 2. authorize
    if (!canProposeSite()) throw new Error("Forbidden");
    // 3. mutate
    const supabase = createAdminSupabase();
    const { data: row, error } = await supabase.from("site").insert({ ... });
    // 4. validate output (via toDTO)
    return { id: row.id };
  }

  /** Map explicitly, never spread. */
  private toDTO(row: Record<string, unknown>): SiteDTO {
    return siteSchema.parse({
      id: row.id,
      type: row.type,
      name: row.name,
      // ... every field mapped by name
    });
  }
}

// data/site/site.actions.ts
"use server";

import { revalidatePath } from "next/cache";
import { SiteDAL } from "./site.dal";

export async function proposeSite(formData: FormData) {
  const dal = await SiteDAL.create();

  const { id } = await dal.propose({
    type: formData.get("type"),
    name: formData.get("name"),
    description: formData.get("description") || undefined,
    address: formData.get("address") || undefined,
    longitude: Number(formData.get("longitude")),
    latitude: Number(formData.get("latitude")),
    schedule: formData.get("schedule") || undefined,
    whatsapp: formData.get("whatsapp") || undefined,
  });

  revalidatePath("/");
  revalidatePath("/admin");
  return { id };
}

export async function findNearbySites(longitude: number, latitude: number) {
  const dal = SiteDAL.public();
  return dal.findNearby(longitude, latitude, 120);
}