import { NextRequest, NextResponse } from "next/server";
import { timingSafeEqual } from "crypto";
import { resetDemo } from "@/lib/demo";

export const dynamic = "force-dynamic";

// Called by the host's threadcount-demo-reset.timer every 20 minutes with the shared token.
export async function POST(req: NextRequest) {
  const want = process.env.DEMO_RESET_TOKEN || "";
  const got = req.headers.get("x-demo-token") || "";
  if (!want || want.length !== got.length || !timingSafeEqual(Buffer.from(want), Buffer.from(got))) return NextResponse.json({ error: "Forbidden" }, { status: 403 });
  const f = await resetDemo();
  return NextResponse.json({ ok: true, facility: f.name, resetAt: f.demoResetAt });
}