import { cookies } from "next/headers";
import { NextResponse, type NextRequest } from "next/server";
import { COOKIE, verifyToken } from "@/lib/auth";

export const dynamic = "force-dynamic";
const API_URL = process.env.API_URL ?? "http://127.0.0.1:8350";

/** Sampled video frames, served through the gate. */
export async function GET(req: NextRequest, ctx: { params: Promise<{ path: string[] }> }) {
  const jar = await cookies();
  if (!verifyToken(jar.get(COOKIE)?.value)) return NextResponse.json({ error: "unauthorized" }, { status: 401 });
  const { path } = await ctx.params;
  const upstream = await fetch(new URL(`/media/${path.map(encodeURIComponent).join("/")}`, API_URL), { cache: "no-store" });
  return new Response(upstream.body, { status: upstream.status, headers: { "content-type": upstream.headers.get("content-type") ?? "image/jpeg", "cache-control": "private, max-age=3600" } });
}