/**
 * Stale-ticket auto-close cron — crm-support-center.
 *
 * POST /api/cron/ticket-close-stale
 *
 * Guarded by CRON_SECRET (timing-safe comparison via @zync/auth#timingSafeEqual).
 * Transitions `resolved` tickets whose `resolved_at` is older than
 * `ticket_auto_close_days` (default 7) to `closed`.
 *
 * Scheduled: daily at 04:00 UTC (wrangler.toml crons, name: ticket-close-stale).
 */
import { Hono } from 'hono'
import { timingSafeEqual } from '@zync/auth'
import { createDb, closeStaleResolvedTickets } from '@zync/db/queries'
import type { AppEnv } from '../../types'

export const ticketCloseStaleCronRoute = new Hono<AppEnv>()

ticketCloseStaleCronRoute.post('/', async (c) => {
  // Timing-safe secret check — never use ===
  const secret = c.req.header('x-cron-secret') ?? ''
  const expected = c.env.CRON_SECRET
  if (!expected || expected.length < 16) {
    return c.json({ error: 'Server misconfigured' }, 500)
  }

  if (!timingSafeEqual(secret, expected)) {
    return c.json({ error: 'Forbidden' }, 403)
  }

  const db = createDb(c.env)
  const closed = await closeStaleResolvedTickets(db)

  return c.json({ closed, ok: true }, 200)
})