import {
  createCipayBuyerHandler,
  createCipayClient,
} from "@cipay/client-sdk/api";
import { allowCipayRequest, rateLimited } from "../shared/rate-limit.js";

// Keep the API key and storefront locator in server-only configuration.
const client = createCipayClient({
  apiKey: process.env.CIPAY_SANDBOX_API_KEY!,
  mode: "sandbox",
});

const handler = createCipayBuyerHandler({
  client,
  storefront: { locator: process.env.CIPAY_STOREFRONT_LOCATOR! },
  resolveCustomer: async (request) => {
    // Trust your verified session and stored mapping, never a browser customer ID.
    const session = await readVerifiedSession(request);
    return session
      ? { subject: session.userId, customerId: session.cipayCustomerId }
      : null;
  },
});

// Rate-limit before the handler reads a body or calls Cipay.
const route = (request: Request) =>
  allowCipayRequest(request) ? handler(request) : rateLimited();

export const GET = route;
export const POST = route;

async function readVerifiedSession(request: Request) {
  // Application integration point: replace this stub with verified server auth.
  void request;
  return null as null | { userId: string; cipayCustomerId: string };
}