import { NextResponse } from "next/server";
import { getToken } from "@/lib/session";

const API_URL = process.env.NEXT_PUBLIC_API_URL;

/**
 * Thin proxy to Laravel DELETE /admin/trash/{type}/{id} (FR-RST-004, BR-033).
 * Exposed as POST here (not DELETE) purely so the browser-facing action
 * matches `TrashActionButton`'s simple `{type, id}` JSON-body call shape,
 * same as the sibling restore proxy — the backend still receives DELETE.
 */
export async function POST(request: Request) {
  const token = await getToken();

  if (!token) {
    return NextResponse.json({ message: "You must log in first." }, { status: 401 });
  }

  const { type, id } = await request.json();

  const apiRes = await fetch(`${API_URL}/admin/trash/${type}/${id}`, {
    method: "DELETE",
    headers: {
      Accept: "application/json",
      Authorization: `Bearer ${token}`,
    },
  });

  const data = await apiRes.json();

  return NextResponse.json(data, { status: apiRes.status });
}