import { NextResponse } from "next/server";
import { z } from "zod";
import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
import { readCookieFromHeader } from "@open-mercato/core/modules/customer_accounts/lib/customerAuth";
const metadata = { requireAuth: false };
async function POST(req) {
  const cookieHeader = req.headers.get("cookie") || "";
  const sessionToken = readCookieFromHeader(cookieHeader, "customer_session_token");
  if (!sessionToken) {
    return NextResponse.json({ ok: false, error: "No session token" }, { status: 401 });
  }
  let decodedToken;
  try {
    decodedToken = decodeURIComponent(sessionToken);
  } catch {
    decodedToken = sessionToken;
  }
  const container = await createRequestContainer();
  const customerSessionService = container.resolve("customerSessionService");
  const customerRbacService = container.resolve("customerRbacService");
  const session = await customerSessionService.findByToken(decodedToken);
  if (!session) {
    return NextResponse.json({ ok: false, error: "Invalid or expired session" }, { status: 401 });
  }
  const user = session.user;
  if (!user || user.deletedAt || !user.isActive) {
    return NextResponse.json({ ok: false, error: "Account not active" }, { status: 401 });
  }
  const acl = await customerRbacService.loadAcl(user.id, {
    tenantId: user.tenantId,
    organizationId: user.organizationId
  });
  const result = await customerSessionService.refreshSession(decodedToken, acl.features);
  if (!result) {
    return NextResponse.json({ ok: false, error: "Session refresh failed" }, { status: 401 });
  }
  const res = NextResponse.json({ ok: true, resolvedFeatures: acl.features });
  res.cookies.set("customer_auth_token", result.jwt, {
    httpOnly: true,
    path: "/",
    sameSite: "lax",
    secure: process.env.NODE_ENV === "production",
    maxAge: 60 * 60 * 8
  });
  return res;
}
const successSchema = z.object({ ok: z.literal(true), resolvedFeatures: z.array(z.string()) });
const errorSchema = z.object({ ok: z.literal(false), error: z.string() });
const methodDoc = {
  summary: "Refresh customer JWT from session token",
  description: "Uses the session cookie to issue a fresh JWT access token.",
  tags: ["Customer Portal"],
  responses: [{ status: 200, description: "Token refreshed", schema: successSchema }],
  errors: [{ status: 401, description: "Invalid session", schema: errorSchema }]
};
const openApi = {
  summary: "Refresh customer session",
  methods: { POST: methodDoc }
};
export {
  POST,
  metadata,
  openApi
};
//# sourceMappingURL=sessions-refresh.js.map
