// Door inbound-log poll. Hit once a minute by the droplet's crontab (see
// docs/DEPLOYMENT.md) to pull access events from each native-HeatSync
// connection that has opted into inbound ingest. Unauthenticated by session
// (cron has none); proxy.ts whitelists this exact path and trust is the
// CRON_SECRET shared secret, compared in constant time.
//
// Each connection's `?z` log is read through the SAME hardened executor as the
// outbound actions (SSRF host pin, no redirects, time/body caps, secret
// redaction). Parsed events are resolved to members and idempotently inserted
// (dedupe_key + ON-CONFLICT no-op), so overlapping runs and unchanged re-polls
// are safe. Generic controllers ingest via the per-connection webhook instead;
// only native_heatsync has a characterized log format to parse.
import { NextRequest, NextResponse } from 'next/server'
import { timingSafeEqual } from 'node:crypto'
import { createAdminClient } from '@/lib/supabase/admin'
import { pollConnectionLog, ingestEvents, type IngestConn } from '@/lib/door/ingest'

export const runtime = 'nodejs'
export const dynamic = 'force-dynamic'

// Bounded work per run: cap the connections polled so a misconfigured fleet
// cannot make one cron tick run unbounded. A single hackerspace has one or two
// doors, so this is generous.
const MAX_CONNECTIONS = 50

function authorized(req: NextRequest): boolean {
  const expected = process.env.CRON_SECRET
  if (!expected) return false
  const header = req.headers.get('authorization') ?? ''
  const provided = header.startsWith('Bearer ') ? header.slice(7) : header
  const a = Buffer.from(provided)
  const b = Buffer.from(expected)
  return a.length === b.length && timingSafeEqual(a, b)
}

export async function POST(req: NextRequest) {
  if (!process.env.CRON_SECRET) {
    return NextResponse.json({ error: 'CRON_SECRET not configured' }, { status: 503 })
  }
  if (!authorized(req)) {
    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
  }

  const admin = createAdminClient()
  const { data: conns, error } = await admin
    .from('door_connections')
    .select('id, space_id, adapter, base_url, pinned_host, auth_param, secret_ref, verbs, is_enabled')
    .eq('is_enabled', true)
    .eq('inbound_enabled', true)
    .eq('adapter', 'native_heatsync')
    .order('created_at', { ascending: true })
    .limit(MAX_CONNECTIONS)
  if (error) return NextResponse.json({ error: error.message }, { status: 500 })

  let polled = 0
  let inserted = 0
  let resolved = 0
  let failed = 0
  for (const c of (conns ?? []) as unknown as IngestConn[]) {
    polled++
    // Isolate each connection: a single misbehaving controller (the body is
    // untrusted, plaintext HTTP) must not 500 the whole run and starve the rest.
    try {
      const poll = await pollConnectionLog(admin, c)
      if (!poll.ok) {
        failed++
        console.error(`[door-ingest] connection ${c.id}: ${poll.detail}`)
        continue
      }
      const res = await ingestEvents(admin, c.space_id, c.id, poll.events)
      inserted += res.inserted
      resolved += res.resolved
    } catch (e) {
      failed++
      console.error(`[door-ingest] connection ${c.id} threw:`, e instanceof Error ? e.message : e)
    }
  }

  return NextResponse.json({ ok: true, polled, inserted, resolved, failed })
}