import { NextRequest, NextResponse } from "next/server";
import { sameOriginJson } from "@/lib/csrf";
import { allow, clientIp } from "@/lib/ratelimit";
import { facilityForEmail, ssoConfigured } from "@/lib/sso";

export const dynamic = "force-dynamic";

/* Does this address belong to a facility that signs in with single sign-on?
 *
 * Asked by the Log in box once an address is typed, so the box can offer "Continue with single
 * sign-on" before anyone reaches for a password. It answers about a DOMAIN, never a person: a
 * facility that registered its domain is a fact about the facility, and the reply carries nothing
 * about whether the address itself has an account. Throttled per address, since it is a lookup
 * anyone may make. */
export async function POST(req: NextRequest) {
  const csrf = sameOriginJson(req);
  if (csrf) return NextResponse.json({ error: csrf }, { status: 403 });
  if (!allow("sso-lookup:" + clientIp(req.headers), 60, 15 * 60 * 1000)) return NextResponse.json({ sso: false });
  if (!ssoConfigured()) return NextResponse.json({ sso: false });
  let body: { email?: unknown };
  try { body = await req.json(); } catch { return NextResponse.json({ error: "Bad request" }, { status: 400 }); }
  const email = String(body.email ?? "").trim().toLowerCase().slice(0, 160);
  const f = await facilityForEmail(email);
  if (!f) return NextResponse.json({ sso: false });
  return NextResponse.json({ sso: true, required: f.ssoRequired, facility: f.name });
}