import { getSessionUser } from "@/lib/auth";
import { isKavenixAdminEmail } from "@/lib/kavenix-admin";
import { resolveRequestCountry } from "@/lib/request-country";
import { getRequestClientIp } from "@/lib/request-client-ip";

export const runtime = "nodejs";
export const dynamic = "force-dynamic";

export async function GET(request: Request) {
  const user = await getSessionUser();
  const headers = { "Cache-Control": "private, no-store, max-age=0" };
  if (!user || !isKavenixAdminEmail(user.email)) {
    return Response.json({ error: user ? "forbidden" : "unauthorized" }, { status: user ? 403 : 401, headers });
  }
  const country = resolveRequestCountry(request.headers);
  // Allowlist only this administrator request's proxy metadata, never cookies or tokens.
  return Response.json({
    clientIp: getRequestClientIp(request.headers),
    countryCode: country.countryCode,
    countrySource: country.source,
    realIp: request.headers.get("x-real-ip")?.slice(0, 128) ?? null,
    forwardedFor: request.headers.get("x-forwarded-for")?.slice(0, 1024) ?? null,
    cloudflareIp: request.headers.get("cf-connecting-ip")?.slice(0, 128) ?? null,
  }, { headers });
}