import { errorResponse, readJson, requireSameOrigin } from "@/lib/security/http";
import { limitRequest } from "@/lib/security/rate-limit";
import { connection } from "next/server";
import * as z from "zod";

import { requireAdmin } from "@/lib/auth/server";
import { updateAdminPresence } from "@/lib/presence";

const inputSchema = z.strictObject({
  tabId: z.string().uuid(),
  guideId: z.string().uuid().nullable(),
  section: z.string().trim().min(1).max(100).nullable(),
  active: z.boolean().default(true),
});

export async function POST(request: Request) {
  await connection();
  try {
    requireSameOrigin(request);
    const admin = await requireAdmin();
    await limitRequest("admin-presence", admin.session.id, 120);
    const parsed = inputSchema.safeParse(await readJson(request, 2048));
    if (!parsed.success) return Response.json({ error: "invalid-presence" }, { status: 400 });
    return Response.json(await updateAdminPresence({
      ...parsed.data,
      memberId: `${admin.session.id}:${parsed.data.tabId}`,
      user: admin.user,
    }), { headers: { "Cache-Control": "no-store" } });
  } catch (cause) {
    return errorResponse(cause);
  }
}