import { NextResponse } from "next/server";

export async function POST(request) {
  const { uuid, code, scope = "nobat724" } = await request.json();

  const API_URL = process.env.NEXT_PUBLIC_API_URL;
  const CLIENT_ID = process.env.CLIENT_ID || process.env.NEXT_PUBLIC_CLIENT_ID;
  const CLIENT_SECRET = process.env.CLIENT_SECRET || process.env.NEXT_PUBLIC_CLIENT_SECRET;

  if (!uuid || !code) {
    return NextResponse.json({ error: "uuid and code are required" }, { status: 400 });
  }

  const formData = new URLSearchParams();
  formData.append("grant_type", "mobile");
  formData.append("client_id", CLIENT_ID);
  formData.append("client_secret", CLIENT_SECRET);
  formData.append("uuid", uuid);
  formData.append("code", code);
  formData.append("scope", scope);

  try {
    const res = await fetch(`${API_URL}/oauth/token`, {
      method: "POST",
      headers: { "Content-Type": "application/x-www-form-urlencoded", Authorization: "" },
      body: formData.toString(),
    });
    const data = await res.json();
    return NextResponse.json(data, { status: res.status });
  } catch {
    return NextResponse.json({ error: "Token request failed" }, { status: 500 });
  }
}