import { NextResponse } from "next/server";
import { secretsMatch } from "@/lib/security/secrets-match";

/**
 * External trigger for the Google Reviews sync — mirrors
 * /api/cron/process-notifications exactly (same CRON_SECRET bearer-token
 * auth, same 503-if-unconfigured / 401-if-wrong / skip-if-not-installed
 * shape). Recommended frequency: every 24 hours — reviews don't change
 * fast enough to justify Google Places API calls any more often than
 * that, and the customer app never calls Google directly regardless (see
 * src/services/reviews/reviews.service.ts).
 *
 * Safe to run concurrently with itself: syncGoogleReviewsForBusiness only
 * overwrites Business.googleRating/googleRatingCount with whatever Google
 * returns, so an overlapping call just re-writes the same two columns,
 * never duplicates anything.
 */
export async function POST(request: Request) {
  if (process.env.MANAGER_MODE === "true") return NextResponse.json({ error: "Not available on Manager." }, { status: 404 });

  const secret = process.env.CRON_SECRET;
  if (!secret) {
    return NextResponse.json({ error: "CRON_SECRET is not configured on this deployment." }, { status: 503 });
  }

  const provided = request.headers.get("authorization");
  if (!provided || !secretsMatch(provided, `Bearer ${secret}`)) {
    return NextResponse.json({ error: "Unauthorized." }, { status: 401 });
  }

  const { isInstalledForRequest } = await import("@/lib/installation/installation-state");
  if (!(await isInstalledForRequest())) {
    return NextResponse.json({ skipped: "not_installed" });
  }

  const [{ prisma }, { syncGoogleReviewsForAllBusinesses }] = await Promise.all([
    import("@/lib/db/prisma"),
    import("@/services/reviews/review-sync.service"),
  ]);
  const results = await syncGoogleReviewsForAllBusinesses(prisma);
  return NextResponse.json({ results });
}