import { NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { assertSameOrigin, requireUser, clientIp } from "@/lib/auth/session";
import { openInquiry } from "@/lib/inquiries/service";
import { hit } from "@/lib/auth/ratelimit";
import { ipHash } from "@/lib/auth/crypto";
import { apiError, handle, parseBody } from "@/lib/api";
export const dynamic = "force-dynamic";
const Body = z.object({ body: z.string().trim().min(10).max(3000), category: z.enum(["INFO", "VISIT", "OFFER"]).default("INFO"), idempotencyKey: z.string().max(80).optional() });
export async function POST(req: NextRequest, { params }: { params: Promise<{ id: string }> }) {
  try { await assertSameOrigin(); const u = await requireUser(); const { id } = await params; const b = await parseBody(req, Body);
    const rl = await hit(`inq:${u.id}`, 20, 3600); const rl2 = await hit(`inq:ip:${ipHash(await clientIp())}`, 40, 3600); if (!rl.ok || !rl2.ok) return apiError(429, "rate_limited", "Trop de demandes envoyées. Réessayez plus tard.");
    const inq = await openInquiry(id, u.id, b.category, b.body, b.idempotencyKey); return NextResponse.json({ ok: true, inquiryId: inq.id }, { status: 201 }); } catch (e) { return handle(e); }
}