import { NextResponse } from "next/server";
import { auth } from "@/auth";
import { getWorkamajig, syncWorkamajig } from "@/lib/workamajig";

export const maxDuration = 300;

/**
 * POST /api/workamajig/sync
 * Trigger a sync. Authorised either by a signed-in ADMIN, or by
 * `Authorization: Bearer <SYNC_SECRET>` for cron (Vercel Cron, GitHub Actions, etc).
 */
export async function POST(req: Request) {
  const secret = process.env.SYNC_SECRET;
  const bearer = req.headers.get("authorization")?.replace(/^Bearer\s+/i, "");
  const session = await auth();
  const ok = (secret && bearer === secret) || session?.user?.role === "ADMIN";
  if (!ok) return NextResponse.json({ error: "forbidden" }, { status: 403 });
  try {
    const counts = await syncWorkamajig(getWorkamajig());
    return NextResponse.json({ ok: true, mode: process.env.WORKAMAJIG_MODE ?? "mock", counts, at: new Date().toISOString() });
  } catch (e) {
    return NextResponse.json({ ok: false, error: (e as Error).message }, { status: 500 });
  }
}