import { NextResponse } from "next/server";
import { z } from "zod";
import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
import {
  validateCrudMutationGuard,
  runCrudMutationGuardAfterSuccess
} from "@open-mercato/shared/lib/crud/mutation-guard";
const FEATURE = "customer_accounts.domain.manage";
const metadata = {
  POST: { requireAuth: true, requireFeatures: [FEATURE] }
};
async function POST(req, ctx) {
  const auth = await getAuthFromRequest(req);
  if (!auth || !auth.tenantId) return NextResponse.json({ ok: false, error: "Unauthorized" }, { status: 401 });
  const container = await createRequestContainer();
  const rbac = container.resolve("rbacService");
  const allowed = await rbac.userHasAllFeatures(auth.sub, [FEATURE], {
    tenantId: auth.tenantId,
    organizationId: auth.orgId
  });
  if (!allowed) return NextResponse.json({ ok: false, error: "Forbidden" }, { status: 403 });
  const { id } = await ctx.params;
  const service = container.resolve("domainMappingService");
  const record = await service.findById(id, { tenantId: auth.tenantId });
  if (!record) return NextResponse.json({ ok: false, error: "Not found" }, { status: 404 });
  const guardResult = await validateCrudMutationGuard(container, {
    tenantId: auth.tenantId,
    organizationId: record.organizationId,
    userId: auth.sub,
    resourceKind: "customer_accounts.domain_mapping",
    resourceId: id,
    operation: "update",
    requestMethod: req.method,
    requestHeaders: req.headers
  });
  if (guardResult && !guardResult.ok) {
    return NextResponse.json(guardResult.body, { status: guardResult.status });
  }
  let updated;
  try {
    updated = await service.healthCheck(id);
  } catch (err) {
    return NextResponse.json(
      { ok: false, error: err instanceof Error ? err.message : "Health check failed" },
      { status: 500 }
    );
  }
  if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
    await runCrudMutationGuardAfterSuccess(container, {
      tenantId: auth.tenantId,
      organizationId: record.organizationId,
      userId: auth.sub,
      resourceKind: "customer_accounts.domain_mapping",
      resourceId: id,
      operation: "update",
      requestMethod: req.method,
      requestHeaders: req.headers,
      metadata: guardResult.metadata ?? null
    });
  }
  return NextResponse.json({
    ok: true,
    domainMapping: {
      id: updated.id,
      hostname: updated.hostname,
      status: updated.status,
      tlsRetryCount: updated.tlsRetryCount,
      tlsFailureReason: updated.tlsFailureReason ?? null
    }
  });
}
const errorSchema = z.object({ ok: z.literal(false), error: z.string() });
const openApi = {
  tag: "CustomerAccounts",
  summary: "TLS health check for a custom domain mapping",
  methods: {
    POST: {
      summary: "Trigger TLS health check",
      description: "Runs an HTTPS probe to verify Traefik has provisioned a certificate. On success: transitions the mapping to active.",
      responses: [
        {
          status: 200,
          description: "OK",
          schema: z.object({
            ok: z.literal(true),
            domainMapping: z.object({
              id: z.string().uuid(),
              hostname: z.string(),
              status: z.string(),
              tlsRetryCount: z.number().int().nonnegative(),
              tlsFailureReason: z.string().nullable()
            })
          })
        }
      ],
      errors: [
        { status: 401, description: "Unauthorized", schema: errorSchema },
        { status: 403, description: "Forbidden", schema: errorSchema },
        { status: 404, description: "Not found", schema: errorSchema }
      ]
    }
  }
};
export {
  POST,
  metadata,
  openApi
};
//# sourceMappingURL=health-check.js.map
