import { errorResponse, readJson, requireSameOrigin } from "@/lib/security/http";
import { limitRequest, trustedClientAddress } from "@/lib/security/rate-limit";
import { connection } from "next/server";
import * as z from "zod";

import { updateVisitorPresence } from "@/lib/presence";

const inputSchema = z.strictObject({
  tabId: z.string().uuid(),
  guideId: z.string().uuid().nullable(),
  active: z.boolean().default(true),
});

export async function POST(request: Request) {
  await connection();
  try {
    requireSameOrigin(request);
    await limitRequest("presence", trustedClientAddress(request.headers), 600);
    const parsed = inputSchema.safeParse(await readJson(request, 1024));
    if (!parsed.success) return Response.json({ error: "invalid-presence" }, { status: 400 });
    return Response.json(await updateVisitorPresence(parsed.data), {
      headers: { "Cache-Control": "no-store" },
    });
  } catch (cause) {
    return errorResponse(cause);
  }
}