import { timingSafeEqual } from 'node:crypto'

import { listActiveDomains } from '@/core/domains/server'

export const dynamic = 'force-dynamic'

const isAuthorized = (request: Request) => {
  const expected = process.env.INTERNAL_TOKEN
  const given = request.headers.get('x-vx-internal-token')
  if (!expected || !given) return false
  const a = Buffer.from(given)
  const b = Buffer.from(expected)
  return a.length === b.length && timingSafeEqual(a, b)
}

/** Список активных доменов для proxy: тот не ходит в Payload сам, а берёт его здесь */
export async function GET(request: Request) {
  if (!isAuthorized(request)) return new Response('Not Found', { status: 404 })
  return Response.json(await listActiveDomains(), { headers: { 'Cache-Control': 'no-store' } })
}