import { NextResponse } from 'next/server'

import { CLEAR_REFRESH_SESSION_HEADER, expiredRefreshSessionSetCookieHeaders } from '@/lib/refreshSessionCookie'

export const dynamic = 'force-dynamic'

/**
 * Browser-side cookie cleanup only: expires Nest httpOnly refresh cookies on this origin.
 * Does not revoke `refresh_tokens` in Nest — an already-exfiltrated token stays valid until
 * expiry unless retried `POST /auth/logout` succeeded. Complementary to `attemptServerLogout`.
 * Requires `x-ghabilee-logout` so a cross-site form POST cannot CSRF-clear cookies.
 */
export function POST(request: Request) {
  if (request.headers.get(CLEAR_REFRESH_SESSION_HEADER) !== '1') {
    return NextResponse.json({ ok: false }, { status: 403 })
  }

  const response = NextResponse.json({ ok: true })

  response.headers.set('Cache-Control', 'no-store')
  for (const cookie of expiredRefreshSessionSetCookieHeaders()) {
    response.headers.append('Set-Cookie', cookie)
  }

  return response
}