import { NextResponse } from "next/server";
import { apiFetch, ApiError } from "@/lib/api/client";
import { getSession } from "@/lib/auth/session";
import type { TotpSetupResponse } from "@/lib/api/types";

// Proxy vers POST /api/mobile/totp/setup.php — exige une session super-admin
// active. Le backend regénère un secret tant que totp_enabled=0, donc cet
// endpoint est rejouable jusqu'à confirmation via /verify.

export async function POST() {
  const session = await getSession();
  if (!session) {
    return NextResponse.json(
      { success: false, error: "Session expirée" },
      { status: 401 },
    );
  }

  try {
    const body = await apiFetch<TotpSetupResponse>("/mobile/totp/setup.php", {
      method: "POST",
      token: session.token,
    });
    if (!body.success || !body.data) {
      return NextResponse.json(
        { success: false, error: body.message ?? "Setup TOTP échoué" },
        { status: 502 },
      );
    }
    return NextResponse.json({
      success: true,
      secret_base32: body.data.secret_base32,
      otpauth_uri: body.data.otpauth_uri,
    });
  } catch (err) {
    if (err instanceof ApiError) {
      return NextResponse.json(
        { success: false, error: err.message ?? "Erreur backend" },
        { status: err.status },
      );
    }
    console.error("[auth/totp/setup] upstream error:", err);
    return NextResponse.json(
      { success: false, error: "Service d'authentification indisponible" },
      { status: 502 },
    );
  }
}