import { NextResponse } from "next/server";
import { callPortalBackend } from "@/lib/backend";
import { createClientSession } from "@/lib/client-session";
import { checkRateLimit, clientAddress } from "@/lib/rate-limit";

export const dynamic = "force-dynamic";

type RouteContext = { params: Promise<{ token: string }> };

export async function POST(request: Request, context: RouteContext) {
  try {
    const { token } = await context.params;
    if (!/^[a-f0-9]{40,64}$/i.test(token)) {
      return NextResponse.json({ ok: false, error: "Lien de dossier invalide." }, { status: 404 });
    }

    const rate = checkRateLimit(`access-verify:${clientAddress(request)}:${token}`, 10, 30 * 60 * 1000);
    if (!rate.allowed) {
      return NextResponse.json(
        { ok: false, error: "Trop de tentatives. Réessayez plus tard." },
        { status: 429, headers: { "Retry-After": String(rate.retryAfter) } },
      );
    }

    const body = (await request.json()) as { code?: string };
    const code = String(body.code || "").trim();
    if (!/^\d{6}$/.test(code)) {
      return NextResponse.json({ ok: false, error: "Le code doit contenir six chiffres." }, { status: 400 });
    }

    const data = await callPortalBackend<{ verified: boolean; reference: string }>({
      action: "verify_access_code",
      token,
      code,
    });
    const response = NextResponse.json({ ok: true, data }, { headers: { "cache-control": "no-store" } });
    const session = createClientSession(token);
    response.cookies.set(session.name, session.value, session.options);
    return response;
  } catch (error) {
    const message = error instanceof Error ? error.message : "Vérification impossible.";
    const status = /incorrect|expiré|aucun code|six chiffres/i.test(message) ? 400 : /bloqué|trop de tentatives/i.test(message) ? 429 : /introuvable|invalide/i.test(message) ? 404 : 502;
    return NextResponse.json({ ok: false, error: message }, { status });
  }
}