import { NextResponse } from "next/server";

/**
 * GET /api/verify-access
 *
 * Returns whether password protection is enabled at runtime.
 * This is called by the PasswordGate client component on mount
 * to determine if it should show the password prompt.
 */
export async function GET() {
  const accessKey = process.env.ACCESS_KEY;
  const enabled = !!accessKey;
  return NextResponse.json({ enabled });
}

/**
 * POST /api/verify-access
 *
 * Validates a submitted key against the ACCESS_KEY environment variable.
 * Returns { valid: true } if matched, { valid: false } otherwise.
 *
 * If ACCESS_KEY is not set, all keys are rejected (locked by default).
 */
export async function POST(request: Request) {
  try {
    const body = await request.json();
    const submitted = body?.key;

    if (typeof submitted !== "string" || !submitted) {
      return NextResponse.json({ valid: false }, { status: 400 });
    }

    const accessKey = process.env.ACCESS_KEY;

    // If no ACCESS_KEY is configured, reject everything
    if (!accessKey) {
      return NextResponse.json({ valid: false }, { status: 403 });
    }

    const valid = submitted === accessKey;
    return NextResponse.json({ valid }, { status: valid ? 200 : 401 });
  } catch {
    return NextResponse.json({ valid: false }, { status: 400 });
  }
}