import { timingSafeEqual } from "node:crypto";
import { NextResponse } from "next/server";
import { runDomainTick } from "@/server/domains/run";
import { env } from "@/server/env";
import { logger } from "@/server/logger";
import { runSchedulerTick } from "@/server/scheduler/run";

// For SCHEDULER_MODE=external: any cron service can POST here every few
// minutes. Authenticated by a shared secret instead of a user session
// (src/proxy.ts lets this path through).

function authorised(request: Request): boolean {
  if (!env.CRON_SECRET) return false;
  const expected = Buffer.from(`Bearer ${env.CRON_SECRET}`);
  const given = Buffer.from(request.headers.get("authorization") ?? "");
  return given.length === expected.length && timingSafeEqual(given, expected);
}

export async function POST(request: Request) {
  // Indistinguishable from a missing route unless the caller holds the secret.
  if (!authorised(request)) return NextResponse.json({ error: "Not found" }, { status: 404 });

  try {
    // The health result stays at the top level; the daily domain check reports under `domains`.
    const [health, domains] = await Promise.all([runSchedulerTick(), runDomainTick()]);
    return NextResponse.json({ ...health, domains });
  } catch (error) {
    logger.error("scheduler.tick.failed", { error, source: "api" });
    return NextResponse.json({ error: "Tick failed" }, { status: 500 });
  }
}