import { NextRequest, NextResponse } from 'next/server';
import { verifyRefreshToken, revokeRefreshToken, verifyAccessToken } from '@/lib/tokens';

export async function POST(request: NextRequest) {
  try {
    const accessToken = request.cookies.get('scriba.access_token')?.value;
    const refreshToken = request.cookies.get('scriba.refresh_token')?.value;

    // Try to get session info from access token first
    let sessionId = null;
    if (accessToken) {
      const tokenPayload = verifyAccessToken(accessToken);
      if (tokenPayload) {
        sessionId = tokenPayload.sessionId;
      }
    }

    // If no access token, try refresh token
    if (!sessionId && refreshToken) {
      const tokenData = await verifyRefreshToken(refreshToken);
      if (tokenData) {
        sessionId = tokenData.sessionId;
      }
    }

    // Revoke the refresh token (and its family for security)
    if (sessionId) {
      await revokeRefreshToken(sessionId, true); // true = revoke entire family
    }

    // Clear all auth cookies
    const response = NextResponse.json({ success: true });
    
    // Clear access token cookie
    response.cookies.set('scriba.access_token', '', {
      httpOnly: true,
      secure: process.env.NODE_ENV === 'production',
      sameSite: 'lax',
      path: '/',
      maxAge: 0,
    });

    // Clear refresh token cookie
    response.cookies.set('scriba.refresh_token', '', {
      httpOnly: true,
      secure: process.env.NODE_ENV === 'production',
      sameSite: 'lax',
      path: '/',
      maxAge: 0,
    });

    // Clear legacy session cookie if it exists
    response.cookies.set('scriba.session', '', {
      httpOnly: true,
      secure: process.env.NODE_ENV === 'production',
      sameSite: 'lax',
      path: '/',
      maxAge: 0,
    });

    return response;
  } catch (error) {
    console.error('Sign-out error:', error);
    return NextResponse.json({ error: 'Logout fallito' }, { status: 500 });
  }
}