import { NextRequest } from 'next/server';
import { putVestSession, listVestSessions } from '@/lib/vest-session';
import { getTradableFirms } from '@/lib/firm-catalog';
import { getClients } from '@/lib/clients';
import { corsJson, corsPreflight } from '../../autobuyer/cors';

/** The wallets this machine's Vest firms trade (their saved credential), lower-case. */
function wantedWallets(): string[] {
    const wallets = getTradableFirms()
        .filter((f) => f.platform === 'vest')
        .map((f) => f.apiKey.trim().toLowerCase());
    return [...new Set(wallets)];
}

/**
 * The extension's Vest relay (lib/vest-session.ts): POST the access token the
 * signed-in Vest tab just renewed — { accessToken, expiresAt, primaryAddr,
 * userId } — and it is held in memory for this machine's Vest client. GET
 * lists what has been relayed (never the tokens) and which wallets this
 * machine wants, so the extension knows whether to keep a Vest tab open and
 * the dashboard can offer the address as the firm's credential.
 *
 * Same LAN-only, any-origin CORS as the AutoBuyer routes: the extension's
 * service worker calls it.
 */
export async function POST(req: NextRequest) {
    let body: Record<string, unknown>;
    try {
        body = await req.json() as Record<string, unknown>;
    } catch {
        return corsJson({ error: 'JSON body required' }, { status: 400 });
    }
    const refused = putVestSession({
        accessToken: body.accessToken,
        expiresAt: body.expiresAt,
        primaryAddr: body.primaryAddr,
        userId: body.userId,
    });
    if (refused) return corsJson({ ok: false, reason: refused }, { status: 400 });

    const wanted = wantedWallets();
    const addr = String(body.primaryAddr).toLowerCase();
    // A client waiting on this wallet's session syncs now, not at its next poll.
    for (const client of getClients().values()) {
        const vest = client as { onVestSession?: (wallet: string) => void };
        vest.onVestSession?.(addr);
    }
    return corsJson({ ok: true, used: wanted.includes(addr), wanted });
}

export async function GET() {
    return corsJson({ sessions: listVestSessions(), wanted: wantedWallets() });
}

export async function OPTIONS() {
    return corsPreflight();
}