import { revalidateTag } from "next/cache";
import type { NextRequest } from "next/server";

/**
 * On-demand cache revalidation. The BFF pings this (fire-and-forget) when
 * sitemap-relevant data changes — a new signup, or a content re-seed/reindex —
 * so /sitemap.xml refreshes within seconds instead of waiting out the 24h ISR
 * window. Secret-gated; lives under /api/ which robots.txt disallows.
 *
 *   POST /api/revalidate?tag=sitemap&secret=…
 */
export const runtime = "nodejs";

export async function POST(req: NextRequest) {
  const expected = process.env.REVALIDATE_SECRET;
  const secret = req.nextUrl.searchParams.get("secret");
  if (!expected || secret !== expected) {
    return Response.json(
      { revalidated: false, error: "unauthorized" },
      { status: 401 },
    );
  }
  const tag = req.nextUrl.searchParams.get("tag") || "sitemap";
  // Next 16 requires a cache-life profile as the 2nd arg; "max" fully purges
  // the tagged entries so the next request re-fetches from the BFF.
  revalidateTag(tag, "max");
  return Response.json({ revalidated: true, tag });
}