Craze-Data-check/api/bc-proxy.js

import { applyCors, isAllowedOrigin } from './_cors.js';
import { getBcConfig, getBCToken, findItem, patchItemCpnpNo } from '../bc-runtime.js';

function setCors(req, res) {
  applyCors(req, res, 'POST, OPTIONS');
}

export default async function handler(req, res) {
  setCors(req, res);

  if (req.method === 'OPTIONS') return res.status(204).end();

  const origin = req.headers.origin;
  if (origin && !isAllowedOrigin(origin)) {
    return res.status(403).json({ error: 'Forbidden' });
  }

  if (req.method !== 'POST') {
    return res.status(405).json({ error: 'Method not allowed' });
  }

  const { articleNo, cpnpNo } = req.body || {};
  if (!articleNo || cpnpNo === undefined) {
    return res.status(400).json({ error: 'Missing articleNo or cpnpNo' });
  }

  try {
    const config = getBcConfig();
    const token = await getBCToken(config);
    const item = await findItem(config, token, articleNo);
    await patchItemCpnpNo(config, token, item, String(cpnpNo));
    return res.json({ success: true, articleNo, cpnpNo });
  } catch (err) {
    console.error('[bc-proxy] error:', err.message);
    return res.status(500).json({ success: false, error: err.message });
  }
}