import { NextResponse } from "next/server";
import { z } from "zod";
import { getCustomerAuthFromRequest, readCookieFromHeader } from "@open-mercato/core/modules/customer_accounts/lib/customerAuth";
import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
import { CustomerUserSession } from "@open-mercato/core/modules/customer_accounts/data/entities";
import { hashToken } from "@open-mercato/core/modules/customer_accounts/lib/tokenGenerator";
const metadata = { requireAuth: false };
async function GET(req) {
  const auth = await getCustomerAuthFromRequest(req);
  if (!auth) {
    return NextResponse.json({ ok: false, error: "Authentication required" }, { status: 401 });
  }
  const container = await createRequestContainer();
  const em = container.resolve("em");
  const sessions = await em.find(CustomerUserSession, {
    user: auth.sub,
    deletedAt: null,
    expiresAt: { $gt: /* @__PURE__ */ new Date() }
  }, { orderBy: { createdAt: "DESC" } });
  const cookieHeader = req.headers.get("cookie") || "";
  const sessionToken = readCookieFromHeader(cookieHeader, "customer_session_token");
  let currentSessionHash = null;
  if (sessionToken) {
    try {
      currentSessionHash = hashToken(decodeURIComponent(sessionToken));
    } catch {
      currentSessionHash = hashToken(sessionToken);
    }
  }
  const items = sessions.map((s) => ({
    id: s.id,
    ipAddress: s.ipAddress,
    userAgent: s.userAgent,
    lastUsedAt: s.lastUsedAt,
    createdAt: s.createdAt,
    expiresAt: s.expiresAt,
    isCurrent: currentSessionHash ? s.tokenHash === currentSessionHash : false
  }));
  return NextResponse.json({ ok: true, sessions: items });
}
const sessionSchema = z.object({
  id: z.string().uuid(),
  ipAddress: z.string().nullable(),
  userAgent: z.string().nullable(),
  lastUsedAt: z.string().datetime().nullable(),
  createdAt: z.string().datetime(),
  expiresAt: z.string().datetime(),
  isCurrent: z.boolean()
});
const methodDoc = {
  summary: "List customer sessions",
  description: "Returns active sessions for the authenticated customer user.",
  tags: ["Customer Portal"],
  responses: [{ status: 200, description: "Session list", schema: z.object({ ok: z.literal(true), sessions: z.array(sessionSchema) }) }],
  errors: [{ status: 401, description: "Not authenticated", schema: z.object({ ok: z.literal(false), error: z.string() }) }]
};
const openApi = {
  summary: "Customer sessions",
  methods: { GET: methodDoc }
};
export {
  GET,
  metadata,
  openApi
};
//# sourceMappingURL=sessions.js.map
