import { NextResponse } from "next/server";
import { z } from "zod";
import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
import {
  validateCrudMutationGuard,
  runCrudMutationGuardAfterSuccess
} from "@open-mercato/shared/lib/crud/mutation-guard";
const FEATURE = "customer_accounts.domain.manage";
const metadata = {
  POST: { requireAuth: true, requireFeatures: [FEATURE] }
};
async function POST(req, ctx) {
  const auth = await getAuthFromRequest(req);
  if (!auth || !auth.tenantId) return NextResponse.json({ ok: false, error: "Unauthorized" }, { status: 401 });
  const container = await createRequestContainer();
  const rbac = container.resolve("rbacService");
  const allowed = await rbac.userHasAllFeatures(auth.sub, [FEATURE], {
    tenantId: auth.tenantId,
    organizationId: auth.orgId
  });
  if (!allowed) return NextResponse.json({ ok: false, error: "Forbidden" }, { status: 403 });
  const { id } = await ctx.params;
  const service = container.resolve("domainMappingService");
  const record = await service.findById(id, { tenantId: auth.tenantId });
  if (!record) return NextResponse.json({ ok: false, error: "Not found" }, { status: 404 });
  const guardResult = await validateCrudMutationGuard(container, {
    tenantId: auth.tenantId,
    organizationId: record.organizationId,
    userId: auth.sub,
    resourceKind: "customer_accounts.domain_mapping",
    resourceId: id,
    operation: "update",
    requestMethod: req.method,
    requestHeaders: req.headers
  });
  if (guardResult && !guardResult.ok) {
    return NextResponse.json(guardResult.body, { status: guardResult.status });
  }
  let result;
  try {
    result = await service.verify(id);
  } catch (err) {
    return NextResponse.json(
      { ok: false, error: err instanceof Error ? err.message : "DNS verification failed" },
      { status: 500 }
    );
  }
  if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
    await runCrudMutationGuardAfterSuccess(container, {
      tenantId: auth.tenantId,
      organizationId: record.organizationId,
      userId: auth.sub,
      resourceKind: "customer_accounts.domain_mapping",
      resourceId: id,
      operation: "update",
      requestMethod: req.method,
      requestHeaders: req.headers,
      metadata: guardResult.metadata ?? null
    });
  }
  return NextResponse.json({
    ok: true,
    domainMapping: {
      id: result.domainMapping.id,
      hostname: result.domainMapping.hostname,
      status: result.domainMapping.status,
      verifiedAt: result.domainMapping.verifiedAt?.toISOString() ?? null,
      lastDnsCheckAt: result.domainMapping.lastDnsCheckAt?.toISOString() ?? null,
      dnsFailureReason: result.domainMapping.dnsFailureReason ?? null
    },
    diagnostics: result.diagnostics ?? null
  });
}
const errorSchema = z.object({ ok: z.literal(false), error: z.string() });
const openApi = {
  tag: "CustomerAccounts",
  summary: "Verify a custom domain mapping (DNS check)",
  methods: {
    POST: {
      summary: "Trigger DNS verification",
      description: "Runs DNS verification (CNAME \u2192 A \u2192 reverse-resolve fallback) for the domain mapping. Returns diagnostics on failure.",
      responses: [
        {
          status: 200,
          description: "OK \u2014 see status",
          schema: z.object({
            ok: z.literal(true),
            domainMapping: z.object({
              id: z.string().uuid(),
              hostname: z.string(),
              status: z.string(),
              verifiedAt: z.string().nullable(),
              lastDnsCheckAt: z.string().nullable(),
              dnsFailureReason: z.string().nullable()
            }),
            diagnostics: z.unknown().nullable()
          })
        }
      ],
      errors: [
        { status: 401, description: "Unauthorized", schema: errorSchema },
        { status: 403, description: "Forbidden", schema: errorSchema },
        { status: 404, description: "Not found", schema: errorSchema }
      ]
    }
  }
};
export {
  POST,
  metadata,
  openApi
};
//# sourceMappingURL=verify.js.map
