import { NextResponse } from "next/server";

export async function POST(req: Request) {
  const { token, role } = await req.json();

  if (!token) {
    return NextResponse.json({ ok: false }, { status: 400 });
  }

  const res = NextResponse.json({ ok: true });

  // Server-readable, JS-unreadable
  res.cookies.set("bb_access_token", token, {
    httpOnly: true,
    secure: process.env.NODE_ENV === "production",
    sameSite: "lax",
    path: "/",
  });

  // Optional: for quick middleware role checks (not “secure” by itself)
  if (role) {
    res.cookies.set("bb_role", role, {
      httpOnly: false,
      secure: process.env.NODE_ENV === "production",
      sameSite: "lax",
      path: "/",
    });
  }

  return res;
}

export async function DELETE() {
  const res = NextResponse.json({ ok: true });
  res.cookies.set("bb_access_token", "", { path: "/", maxAge: 0 });
  res.cookies.set("bb_role", "", { path: "/", maxAge: 0 });
  return res;
}