import * as z from "zod";
import { requireCommentViewer } from "@/lib/comments/repository";
import { markCommentsRead, unreadCommentCounts } from "@/lib/comments/unread";
import { errorResponse, HttpError, readJson, requireSameOrigin } from "@/lib/security/http";
import { limitRequest } from "@/lib/security/rate-limit";

export async function GET() {
  try { return Response.json(await unreadCommentCounts(await requireCommentViewer()), { headers: { "Cache-Control": "private, no-store" } }); }
  catch (cause) { return errorResponse(cause); }
}
export async function POST(request: Request) {
  try {
    requireSameOrigin(request);
    const viewer = await requireCommentViewer();
    await limitRequest("comment-read", viewer.id, 120);
    const body = z.object({ target: z.string().max(80) }).safeParse(await readJson(request, 1024));
    if (!body.success) throw new HttpError(400, "invalid-target");
    await markCommentsRead(viewer, body.data.target);
    return new Response(null, { status: 204 });
  } catch (cause) { return errorResponse(cause); }
}