import { NextResponse } from "next/server";
import { db } from "@/db";
import { consentEvents } from "@/db/schema";
import { currentUser } from "@/lib/auth";
import { readJson } from "@/lib/api-security";

export async function POST(request: Request) {
  if (!db) return NextResponse.json({ ok: true });
  const body = await readJson<{ purpose?: unknown; granted?: unknown; revision?: unknown }>(request, 2 * 1024);
  if (body.purpose !== "analytics" || typeof body.granted !== "boolean" || !Number.isInteger(body.revision)) return NextResponse.json({ error: "bad_request" }, { status: 400 });
  const user = await currentUser();
  await db.insert(consentEvents).values({ userId: user?.id, customerRef: user?.customerRef, purpose: "analytics", policyRevision: Number(body.revision), granted: body.granted, source: "cookie_banner", ip: request.headers.get("x-forwarded-for")?.split(",")[0]?.trim().slice(0, 64), userAgent: request.headers.get("user-agent")?.slice(0, 512) });
  return NextResponse.json({ ok: true });
}