import { NextResponse } from "next/server";
import { assertIT } from "@/lib/correo-server";

// Pagos validados reales: proxy server-side a
// GET /api/Boletas/payments?mes=&year= (endpoint público de SAM.API,
// no requiere Bearer). Requiere sesión IT para verlo en el portal.
const SAM_API_URL =
  process.env.SAM_API_URL ??
  process.env.NEXT_PUBLIC_API_URL ??
  "https://api.devops.norteamericano.cl";

export async function GET(req: Request): Promise<Response> {
  try {
    await assertIT(req);
    const url = new URL(req.url);
    const now = new Date();
    const mes = url.searchParams.get("mes") ?? String(now.getMonth() + 1);
    const year = url.searchParams.get("year") ?? String(now.getFullYear());
    const m = Number(mes);
    const y = Number(year);
    if (!Number.isInteger(m) || m < 1 || m > 12 || !Number.isInteger(y) || y < 2000 || y > 2100) {
      return NextResponse.json({ error: "mes (1-12) y year válidos requeridos" }, { status: 400 });
    }
    const res = await fetch(
      `${SAM_API_URL}/api/Boletas/payments?mes=${m}&year=${y}`,
      { cache: "no-store" }
    );
    const text = await res.text();
    try {
      return NextResponse.json(JSON.parse(text), { status: res.status });
    } catch {
      return new NextResponse(text, { status: res.status });
    }
  } catch (e) {
    const status =
      typeof e === "object" && e !== null && "status" in e
        ? Number((e as { status: unknown }).status) || 500
        : 500;
    return NextResponse.json(
      { error: e instanceof Error ? e.message : "Error" },
      { status }
    );
  }
}