import { NextRequest, NextResponse } from 'next/server';
import { getValidTiktokTokens } from '@/lib/tiktok';

export async function GET(request: NextRequest) {
  const adminKey = process.env.TIKTOK_ADMIN_KEY;
  if (!adminKey) {
    // Unlike /connect, this endpoint hands out live credentials — never expose
    // it without a configured key.
    return NextResponse.json(
      { error: 'TIKTOK_ADMIN_KEY must be configured to expose tokens' },
      { status: 500 }
    );
  }

  const provided =
    request.headers.get('x-admin-key') || request.nextUrl.searchParams.get('key');
  if (provided !== adminKey) {
    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
  }

  try {
    const tokens = await getValidTiktokTokens();
    if (!tokens) {
      return NextResponse.json(
        { error: 'No TikTok account connected. Visit /api/tiktok/connect first.' },
        { status: 404 }
      );
    }

    return NextResponse.json({
      access_token: tokens.accessToken,
      open_id: tokens.openId,
      scope: tokens.scope,
      expires_at: tokens.accessTokenExpiresAt.toISOString(),
    });
  } catch (err) {
    console.error('TikTok token endpoint error:', err);
    const message = err instanceof Error ? err.message : 'Unknown error';
    return NextResponse.json({ error: message }, { status: 502 });
  }
}