// BFF proxy. Any request the SPA makes to /api/backend/<path> is forwarded
// to the configured backend with the authenticated user's context attached.
//
// Customise: pull session via `app.require("identityProvider").getSession(req)`
// and inject headers (user id, roles, tenant) before forwarding. Treat the
// backend as the source of truth; this layer is just routing + identity.

import { proxyToBackend } from "@/lib/backend-client";
import { app } from "@/lib/runtime";

async function forward(req: Request, { params }: { params: Promise<{ path: string[] }> }) {
  const { path } = await params;
  const session = await app.require("identityProvider").getSession(req);

  // Strip hop-by-hop headers + the host header (would point at the BFF, not
  // the backend); pass everything else through.
  const outboundHeaders = new Headers(req.headers);
  outboundHeaders.delete("host");
  outboundHeaders.delete("connection");
  if (session) {
    outboundHeaders.set("x-rd-user-id", session.user.id);
    outboundHeaders.set("x-rd-organization-id", session.user.organizationId);
    outboundHeaders.set("x-rd-roles", session.user.roles.join(","));
  }

  return proxyToBackend(path.join("/"), {
    method: req.method,
    headers: outboundHeaders,
    body: req.method === "GET" || req.method === "HEAD" ? undefined : await req.arrayBuffer(),
  });
}

export const GET = forward;
export const POST = forward;
export const PUT = forward;
export const PATCH = forward;
export const DELETE = forward;