import { NextRequest, NextResponse } from 'next/server'
import { getDb } from '@/lib/db'

const INTERNAL_KEY = process.env.INTERNAL_API_KEY || 'oa-internal-key-tlyq-2026'

export async function GET(request: NextRequest) {
  const key = request.headers.get('x-internal-key')
  if (key !== INTERNAL_KEY) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })

  const db = getDb()
  const roles = db.prepare('SELECT name, display_name FROM roles ORDER BY name').all() as { name: string; display_name: string }[]
  return NextResponse.json({ roles })
}