// GET  /api/ancpi/cleanup?dryRun=1  — preview what would be deleted
// POST /api/ancpi/cleanup           — run the cleanup now
//
// On-demand control over the 45-day ePay extract auto-cleanup (the scheduler
// in epay-cleanup.ts runs it automatically on boot + every 24h). Useful to
// preview (dryRun) before trusting the automatic run, or to trigger it now.
//
// Auth: a staff session (requireCfAccess), OR a cron Bearer token
// (EPAY_CLEANUP_CRON_SECRET / NOTIFICATION_CRON_SECRET) so an external
// scheduler can call it. ?days overrides the retention window.

import { NextResponse } from "next/server";
import {
  cleanupExpiredEpayExtracts,
  EPAY_RETENTION_DAYS,
} from "@/modules/parcel-sync/services/epay-cleanup";
import { requireCfAccess } from "@/core/auth/cf-access";

export const runtime = "nodejs";
export const dynamic = "force-dynamic";

function cronAuthorized(req: Request): boolean {
  const secret =
    process.env.EPAY_CLEANUP_CRON_SECRET ?? process.env.NOTIFICATION_CRON_SECRET;
  if (!secret) return false;
  const auth = req.headers.get("authorization") ?? "";
  return auth === `Bearer ${secret}`;
}

async function authorize(req: Request): Promise<boolean> {
  if (cronAuthorized(req)) return true;
  const access = await requireCfAccess();
  return access.ok;
}

function parseDays(req: Request): number {
  const raw = new URL(req.url).searchParams.get("days");
  const n = raw ? parseInt(raw, 10) : NaN;
  return Number.isFinite(n) && n > 0 ? n : EPAY_RETENTION_DAYS;
}

export async function GET(req: Request) {
  if (!(await authorize(req))) {
    return NextResponse.json({ error: "Neautorizat." }, { status: 401 });
  }
  // GET is always a dry-run (no side effects) — safe to preview from a browser.
  const result = await cleanupExpiredEpayExtracts({
    olderThanDays: parseDays(req),
    dryRun: true,
  });
  return NextResponse.json(result);
}

export async function POST(req: Request) {
  if (!(await authorize(req))) {
    return NextResponse.json({ error: "Neautorizat." }, { status: 401 });
  }
  const dryRun = new URL(req.url).searchParams.get("dryRun") === "1";
  const result = await cleanupExpiredEpayExtracts({
    olderThanDays: parseDays(req),
    dryRun,
  });
  return NextResponse.json(result);
}