ANTOOZA-FRONTEND/app/api/auth/[...path]/route.ts

import { NextRequest, NextResponse } from 'next/server';
import { ResultDto } from '@/types/response/common';
import { LoginResponse } from '@/types/response/auth';
import { fetchJson } from '@/lib/utils/server';

export async function GET(request: NextRequest, { params }: { params: Promise<{ path: string[] }> })
{
	const { path } = await params;
	const searchParams = request.nextUrl.searchParams.toString();
	const endpoint = `/api/auth/${path.join('/')}${searchParams ? `?${searchParams}` : ''}`;

	const res: ResultDto = await fetchJson(endpoint, {
		method: 'GET'
	});

	return NextResponse.json(res);
}

export async function POST(request: NextRequest, { params }: { params: Promise<{ path: string[] }> })
{
	const { path } = await params;
	const endpoint = `/api/auth/${path.join('/')}`;
	let body: Record<string, unknown>|null = null;

	if (request.headers.get('content-type')?.includes('application/json')) {
		body = await request.json();
	}

	// refresh-token 은 클라이언트에서 httpOnly 쿠키를 읽을 수 없으므로
	// 라우트 핸들러가 쿠키의 refreshToken 을 body 로 자동 주입
	if (path[0] === 'refresh-token' && !body) {
		const rt = request.cookies.get('refreshToken')?.value;
		if (rt) {
			body = { RefreshToken: rt };
		}
	}

	const res: ResultDto = await fetchJson(endpoint, {
		method: 'POST',
	    ...(body && { body: JSON.stringify(body) })
	});

	const response = NextResponse.json(res);

	// 로그인 또는 토큰 갱신 성공 시 쿠키 설정
	if ((path[0] === 'login' || path[0] === 'google-login' || path[0] === 'refresh-token') && res.success && res.data) {
		const data = res.data as LoginResponse;
		// RefreshToken TTL(백엔드 7일) 에 맞춤. accessToken 자체 exp 는 짧지만 쿠키 수명은 refresh 와 동일하게 잡아 OS 슬립/탭 재개 후에도 세션 유지.
		const sevenDaysSec = 7 * 24 * 60 * 60;
		const cookieOptions = {
			httpOnly: true,
			path: '/',
			sameSite: 'lax' as const,
			secure: process.env.NODE_ENV === 'production',
			maxAge: sevenDaysSec
		};
		response.cookies.set('accessToken', data.accessToken, cookieOptions);
		response.cookies.set('refreshToken', data.refreshToken, cookieOptions);
	}

	if (path[0] === 'logout') {
		response.cookies.delete('accessToken');
		response.cookies.delete('refreshToken');
	}

	return response;
}