Craze-Data-check/api/bc-sync-apply.js

import { getBcConfig, getBCToken } from '../bc-runtime.js';
import { applyBusinessCentralCpnp, applyBusinessCentralSync } from '../bc-sync-runtime.js';

const ALLOWED_ORIGINS = [
  'http://localhost:3000',
  'http://localhost:4173',
  'http://localhost:5173',
  'https://craze-data-check.vercel.app',
];

function setCors(req, res) {
  const origin = req.headers.origin;
  if (origin && ALLOWED_ORIGINS.includes(origin)) {
    res.setHeader('Access-Control-Allow-Origin', origin);
  }
  res.setHeader('Access-Control-Allow-Methods', 'POST, OPTIONS');
  res.setHeader('Access-Control-Allow-Headers', 'Content-Type');
  res.setHeader('Vary', 'Origin');
}

export default async function handler(req, res) {
  setCors(req, res);

  if (req.method === 'OPTIONS') return res.status(204).end();

  const origin = req.headers.origin;
  if (origin && !ALLOWED_ORIGINS.includes(origin)) {
    return res.status(403).json({ error: 'Forbidden' });
  }

  if (req.method !== 'POST') {
    return res.status(405).json({ error: 'Method not allowed' });
  }

  const { headers, row, articleNo, cpnpNo, previewToken } = req.body || {};

  try {
    const config = getBcConfig();
    const token = await getBCToken(config);

    if (Array.isArray(headers) && Array.isArray(row)) {
      const result = await applyBusinessCentralSync(config, token, headers, row, previewToken);
      return res.json({ success: true, ...result });
    }

    if (articleNo && cpnpNo !== undefined) {
      const result = await applyBusinessCentralCpnp(config, token, articleNo, cpnpNo, previewToken);
      return res.json(result);
    }

    return res.status(400).json({ error: 'Missing headers/row or articleNo/cpnpNo' });
  } catch (err) {
    console.error('[bc-sync-apply] error:', err.message);
    return res.status(err.statusCode || 500).json({ success: false, error: err.message });
  }
}