import { NextRequest, NextResponse } from "next/server";

const SPREE_URL = process.env.NEXT_PUBLIC_SPREE_API_URL || "https://api.jux-lab.com";
const API_KEY = process.env.NEXT_PUBLIC_SPREE_API_KEY || "";

export async function GET(req: NextRequest) {
  const token = req.headers.get("Authorization")?.replace("Bearer ", "");
  if (!token) return NextResponse.json({ error: "No token" }, { status: 401 });

  // Spree's store API wants the store key AND the customer token. Sending only
  // the Bearer answers 401 "Valid API key required" — which is what this route
  // did from the day it was written, so the profile never loaded at all.
  const res = await fetch(`${SPREE_URL}/api/v3/store/customers/me`, {
    headers: {
      Authorization: `Bearer ${token}`,
      "X-Spree-Api-Key": API_KEY,
    },
  });
  const data = await res.json();
  return NextResponse.json(data, { status: res.status });
}

export async function PATCH(req: NextRequest) {
  const token = req.headers.get("Authorization")?.replace("Bearer ", "");
  if (!token) return NextResponse.json({ error: "No token" }, { status: 401 });

  const body = await req.json();
  const res = await fetch(`${SPREE_URL}/api/v3/store/customers/me`, {
    method: "PATCH",
    headers: {
      Authorization: `Bearer ${token}`,
      "Content-Type": "application/json",
      "X-Spree-Api-Key": API_KEY,
    },
    body: JSON.stringify(body),
  });
  const data = await res.json();
  return NextResponse.json(data, { status: res.status });
}