import { upsertSchedule } from '@/lib/runtime.js';
import { requireSession } from '@/lib/auth.js';
export const runtime = 'nodejs';
export const dynamic = 'force-dynamic';
export async function POST(req) {
  try {
    const session = await requireSession(req);
    const body = await req.json();
    // RD-1: capture session identity so service-principal propagation (Task #7) can attribute schedules
    const payload = session.user_id ? { ...body, created_by_user_id: body.created_by_user_id ?? session.user_id } : body;
    return Response.json(upsertSchedule(payload));
  } catch (err) {
    if (err && typeof err === 'object' && err.status) {
      return Response.json({ error: err.error || 'unauthorized' }, { status: err.status });
    }
    return Response.json({ error: err.message }, { status: 400 });
  }
}
