// Express proxy for @outlevo/components: app.use('/api/outlevo', outlevoProxy()). The key stays in OUTLEVO_KEY.
import { randomUUID } from 'node:crypto';
import express, { type Router } from 'express';

const ALLOW: Array<[string, RegExp]> = [
  ['GET', /^\/v1\/handoffs\/[0-9a-f-]{36}$/],
  ['POST', /^\/v1\/handoffs\/[0-9a-f-]{36}\/(accept|reject)$/],
  ['GET', /^\/v1\/revenue-actions$/],
  ['GET', /^\/v1\/revenue-actions\/[0-9a-f-]{36}$/],
];

export function outlevoProxy(): Router {
  const r = express.Router();
  r.use(express.text({ type: '*/*' }));
  r.all('*', async (req, res) => {
    if (!ALLOW.some(([m, re]) => m === req.method && re.test(req.path))) return res.status(403).json({ error: { code: 'FORBIDDEN', message: 'Not proxied' } });
    const out = await fetch(`https://api.outlevo.com${req.originalUrl.replace(/^.*?\/v1\//, '/v1/')}`, {
      method: req.method,
      headers: { authorization: `Bearer ${process.env.OUTLEVO_KEY}`, 'content-type': 'application/json', ...(req.method === 'POST' ? { 'idempotency-key': randomUUID() } : {}) },
      body: req.method === 'POST' ? String(req.body ?? '') : undefined,
    });
    res.status(out.status).type('application/json').send(await out.text());
  });
  return r;
}