import { NextResponse } from "next/server";
import { TOKEN_COOKIE } from "@/lib/session";

const API_URL = process.env.NEXT_PUBLIC_API_URL;

/**
 * Thin proxy to Laravel POST /auth/login. On success, stores the Sanctum
 * Bearer token in an httpOnly cookie (never readable by client JS) instead
 * of returning it to the browser — the recommended pattern for a Next.js
 * "backend for frontend" in front of an external token-based API.
 */
export async function POST(request: Request) {
  const body = await request.json();

  const apiRes = await fetch(`${API_URL}/auth/login`, {
    method: "POST",
    headers: { "Content-Type": "application/json", Accept: "application/json" },
    body: JSON.stringify(body),
  });

  const data = await apiRes.json();

  if (!apiRes.ok) {
    return NextResponse.json(data, { status: apiRes.status });
  }

  const response = NextResponse.json({ data: data.data.user });

  response.cookies.set({
    name: TOKEN_COOKIE,
    value: data.data.token,
    httpOnly: true,
    secure: process.env.NODE_ENV === "production",
    sameSite: "lax",
    path: "/",
    maxAge: 60 * 60 * 24 * 7,
  });

  return response;
}