import { applyCors, isAllowedOrigin } from './_cors.js';
import { getBcConfig, getBCToken, getItemsUrl } from '../bc-runtime.js';

function setCors(req, res) {
  applyCors(req, res, 'GET, OPTIONS');
}

export default async function handler(req, res) {
  setCors(req, res);

  if (req.method === 'OPTIONS') return res.status(204).end();

  const origin = req.headers.origin;
  if (origin && !isAllowedOrigin(origin)) {
    return res.status(403).json({ error: 'Forbidden' });
  }

  if (req.method !== 'GET') {
    return res.status(405).json({ error: 'Method not allowed' });
  }

  try {
    const config = getBcConfig();
    const token = await getBCToken(config);
    const itemsUrl = getItemsUrl(config);

    // Note: $select suppresses @odata.nextLink on this BC API, so page manually with $skip.
    const TOP = 1000;
    const values = {};
    for (let skip = 0; ; skip += TOP) {
      const response = await fetch(`${itemsUrl}?$select=no,empCOCompliant&$top=${TOP}&$skip=${skip}`, {
        headers: { Authorization: `Bearer ${token}`, Accept: 'application/json' },
      });
      if (!response.ok) {
        const txt = await response.text();
        throw new Error(`BC GET items failed (${response.status}): ${txt}`);
      }
      const json = await response.json();
      const page = json.value || [];
      for (const item of page) {
        if (item.no !== undefined && item.no !== null) {
          values[String(item.no)] = Boolean(item.empCOCompliant);
        }
      }
      if (page.length < TOP) break;
    }

    res.setHeader('Cache-Control', 's-maxage=300, stale-while-revalidate=600');
    return res.json({ success: true, count: Object.keys(values).length, values });
  } catch (err) {
    console.error('[bc-empco] error:', err.message);
    return res.status(500).json({ success: false, error: err.message });
  }
}