import "server-only";
import { NextResponse } from "next/server";
import { type Permission, hasPermission } from "@/lib/auth/permissions";
import { getCurrentSession } from "@/server/auth/current-user";
import { type ValidatedSession } from "@/server/auth/session-service";
import { isSameOriginRequest } from "@/server/http/same-origin";

export function jsonError(status: number, error: string): NextResponse {
  return NextResponse.json({ error }, { status, headers: { "Cache-Control": "no-store" } });
}

type ApiAuthResult =
  { ok: true; session: ValidatedSession } | { ok: false; response: NextResponse };

/**
 * Autorización server-side para Route Handlers del panel.
 * - 401 sin sesión válida.
 * - 403 sin el permiso.
 * - 403 si es una mutación (no GET/HEAD) desde otro origen (CSRF).
 */
export async function authorizeApiRequest(
  request: Request,
  permission?: Permission,
): Promise<ApiAuthResult> {
  const isMutation = !["GET", "HEAD"].includes(request.method);
  if (isMutation && !isSameOriginRequest(request)) {
    return { ok: false, response: jsonError(403, "Origen no permitido") };
  }
  const session = await getCurrentSession();
  if (!session) return { ok: false, response: jsonError(401, "No autenticado") };
  if (permission && !hasPermission(session.permissions, permission)) {
    return { ok: false, response: jsonError(403, "Sin permiso") };
  }
  return { ok: true, session };
}