import { NextResponse } from 'next/server'
import { cookies } from 'next/headers'
import { verifySharedJwt } from '@/lib/jwt'
import { isLldapAdmin } from '@/lib/ldap'

const INTERNAL_KEY = 'oa-internal-key-tlyq-2026'

async function fetchRoles(url: string): Promise<{ name: string; display_name: string }[]> {
  try {
    const res = await fetch(`${url}/api/internal/roles`, {
      headers: { 'x-internal-key': INTERNAL_KEY },
      signal: AbortSignal.timeout(5000),
    })
    const data = await res.json()
    return data.roles || []
  } catch { return [] }
}

export async function GET() {
  const cookieStore = await cookies()
  const token = cookieStore.get('tlyq_session')?.value
  if (!token) return NextResponse.json({ error: '未登录' }, { status: 401 })
  const session = verifySharedJwt(token)
  if (!session || !(await isLldapAdmin(session.username))) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })

  const [assetsRoles, issueRoles] = await Promise.all([
    fetchRoles('http://assets-ai:3000'),
    fetchRoles('http://issue-ai:3000'),
  ])

  return NextResponse.json({ assets: assetsRoles, issue: issueRoles })
}