import { NextResponse } from "next/server";
import { REST_POST } from "@payloadcms/next/routes";
import config from "@payload-config";
import { verifyTurnstileToken } from "@/lib/turnstile/server";

export const dynamic = "force-dynamic";

const payloadPost = REST_POST(config);

function isRecord(value: unknown): value is Record<string, unknown> {
  return typeof value === "object" && value !== null && !Array.isArray(value);
}

export async function POST(request: Request) {
  let body: unknown;
  try {
    body = await request.clone().json();
  } catch {
    return NextResponse.json({ error: "Sicherheitsprüfung fehlgeschlagen. Bitte versuche es erneut." }, { status: 403 });
  }

  const token = isRecord(body) ? body.token : undefined;
  if (!(await verifyTurnstileToken(token, "registration", request))) {
    return NextResponse.json({ error: "Sicherheitsprüfung fehlgeschlagen. Bitte versuche es erneut." }, { status: 403 });
  }

  const sanitizedBody = isRecord(body) ? { ...body } : body;
  if (isRecord(sanitizedBody)) delete sanitizedBody.token;
  const headers = new Headers(request.headers);
  headers.delete("content-length");
  headers.set("content-type", "application/json");
  const downstreamRequest = new Request(request.url, {
    method: request.method,
    headers,
    body: JSON.stringify(sanitizedBody),
  });
  return payloadPost(downstreamRequest, { params: Promise.resolve({ slug: ["customers"] }) });
}