// Supabase Edge Function: proxies the component paths to Outlevo with a server-side key.
// supabase secrets set OUTLEVO_KEY=olv_test_...   (never put the key in your frontend)
const ALLOW: Array<[string, RegExp]> = [
  ['GET', /^\/v1\/handoffs\/[0-9a-f-]{36}$/],
  ['POST', /^\/v1\/handoffs\/[0-9a-f-]{36}\/(accept|reject)$/],
  ['GET', /^\/v1\/revenue-actions$/],
];

Deno.serve(async (req) => {
  const url = new URL(req.url);
  const path = url.pathname.replace(/^\/outlevo-proxy/, '');
  if (!ALLOW.some(([m, re]) => m === req.method && re.test(path))) return Response.json({ error: { code: 'FORBIDDEN', message: 'Not proxied' } }, { status: 403 });
  const res = await fetch(`https://api.outlevo.com${path}${url.search}`, {
    method: req.method,
    headers: { authorization: `Bearer ${Deno.env.get('OUTLEVO_KEY')}`, 'content-type': 'application/json', ...(req.method === 'POST' ? { 'idempotency-key': crypto.randomUUID() } : {}) },
    body: req.method === 'POST' ? await req.text() : undefined,
  });
  return new Response(await res.text(), { status: res.status, headers: { 'content-type': 'application/json' } });
});