import { NextResponse } from "next/server";

const COOKIE = "sam_pruebas_alumno";

/** Login alumno: reenvía a SAM.API POST /api/sam-pruebas/login-alumno
 *  (valida idAlumno + Contrasena en sige_sam_v3 o sige_sam_empresa). */
export async function POST(req: Request) {
  const body = await req.json().catch(() => ({}));
  const base = process.env.API_URL || process.env.NEXT_PUBLIC_API_URL || "http://localhost:5000";
  const r = await fetch(`${base}/api/sam-pruebas/login-alumno`, {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({ idAlumno: (body.idAlumno || "").trim(), password: body.password || "" })
  });
  const data = await r.json().catch(() => null);
  if (!r.ok || !data?.success) {
    return NextResponse.json({ success: false, message: "Credenciales inválidas" }, { status: 401 });
  }
  const res = NextResponse.json({ success: true, user: data.user });
  res.cookies.set(COOKIE, encodeURIComponent(JSON.stringify(data.user)), {
    httpOnly: true,
    path: "/",
    maxAge: 60 * 60 * 12,
    sameSite: "lax"
  });
  return res;
}