// Next.js App Router proxy for @outlevo/components. The Outlevo key stays on the server (OUTLEVO_KEY).
// Only the paths the components need are forwarded; everything else is refused.
import { NextRequest, NextResponse } from 'next/server';

const ALLOW: Array<[string, RegExp]> = [
  ['GET', /^\/v1\/handoffs\/[0-9a-f-]{36}$/],
  ['POST', /^\/v1\/handoffs\/[0-9a-f-]{36}\/(accept|reject)$/],
  ['GET', /^\/v1\/revenue-actions$/],
  ['GET', /^\/v1\/revenue-actions\/[0-9a-f-]{36}$/],
];

async function forward(req: NextRequest, { params }: { params: Promise<{ path: string[] }> }) {
  const path = `/${(await params).path.join('/')}`;
  if (!ALLOW.some(([m, re]) => m === req.method && re.test(path))) return NextResponse.json({ error: { code: 'FORBIDDEN', message: 'Not proxied' } }, { status: 403 });
  // Map your signed-in user to their Outlevo key here. Accept/reject need a key bound to that rep.
  const key = process.env.OUTLEVO_KEY;
  if (!key) return NextResponse.json({ error: { code: 'INTEGRATION_NOT_CONFIGURED', message: 'Set OUTLEVO_KEY on the server' } }, { status: 500 });
  const res = await fetch(`https://api.outlevo.com${path}${req.nextUrl.search}`, {
    method: req.method,
    headers: { authorization: `Bearer ${key}`, 'content-type': 'application/json', ...(req.method === 'POST' ? { 'idempotency-key': crypto.randomUUID() } : {}) },
    body: req.method === 'POST' ? await req.text() : undefined,
  });
  return new NextResponse(await res.text(), { status: res.status, headers: { 'content-type': 'application/json' } });
}

export { forward as GET, forward as POST };