import { NextResponse } from "next/server";
import { callPortalBackend } from "@/lib/backend";
import { checkRateLimit, clientAddress } from "@/lib/rate-limit";

export const dynamic = "force-dynamic";

type RouteContext = { params: Promise<{ token: string }> };

export async function POST(request: Request, context: RouteContext) {
  try {
    const { token } = await context.params;
    if (!/^[a-f0-9]{40,64}$/i.test(token)) {
      return NextResponse.json({ ok: false, error: "Lien de dossier invalide." }, { status: 404 });
    }

    const rate = checkRateLimit(`access-code:${clientAddress(request)}:${token}`, 5, 60 * 60 * 1000);
    if (!rate.allowed) {
      return NextResponse.json(
        { ok: false, error: "Nombre maximal de codes atteint. Réessayez plus tard." },
        { status: 429, headers: { "Retry-After": String(rate.retryAfter) } },
      );
    }

    const data = await callPortalBackend<{
      sent: boolean;
      maskedEmail: string;
      expiresInSeconds: number;
    }>({ action: "request_access_code", token });
    return NextResponse.json({ ok: true, data }, { headers: { "cache-control": "no-store" } });
  } catch (error) {
    const message = error instanceof Error ? error.message : "Envoi du code impossible.";
    const status = /introuvable|invalide/i.test(message) ? 404 : /patientez|nombre maximal|bloqué/i.test(message) ? 429 : 502;
    return NextResponse.json({ ok: false, error: message }, { status });
  }
}