import { NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { assertSameOrigin, requireUser } from "@/lib/auth/session";
import { requestViewing } from "@/lib/inquiries/service";
import { hit } from "@/lib/auth/ratelimit";
import { apiError, handle, parseBody } from "@/lib/api";
export const dynamic = "force-dynamic";
const Body = z.object({ slots: z.array(z.string().datetime({ offset: true })).min(1).max(3), note: z.string().trim().max(500).optional() });
export async function POST(req: NextRequest, { params }: { params: Promise<{ id: string }> }) {
  try { await assertSameOrigin(); const u = await requireUser(); const { id } = await params; const b = await parseBody(req, Body);
    if (b.slots.some((s) => Date.parse(s) < Date.now() - 3600000)) return apiError(400, "invalid_slot", "Les créneaux doivent être à venir");
    const rl = await hit(`view:${u.id}`, 10, 86400); if (!rl.ok) return apiError(429, "rate_limited", "Trop de demandes de visite aujourd'hui.");
    const v = await requestViewing(id, u.id, b.slots, b.note); return NextResponse.json({ ok: true, viewingId: v.id }, { status: 201 }); } catch (e) { return handle(e); }
}