/**
 * Webhook log retention cron — webhook-endpoint-detail (wave-11 leaf-D).
 * Invoked daily at 01:00 UTC via the cron dispatcher.
 * Deletes webhook_delivery_log rows older than 90 days.
 *
 * Guarded by CRON_SECRET (timing-safe comparison via @zync/auth#timingSafeEqual).
 */
import { Hono } from 'hono'
import { timingSafeEqual } from '@zync/auth'
import type { AppEnv } from '../../types'
import { createDb, deleteOldWebhookDeliveryLogs } from '@zync/db/queries'

export const webhookLogRetentionCron = new Hono<AppEnv>()

webhookLogRetentionCron.post('/', async (c) => {
  // Timing-safe secret check — never use ===
  const secret = c.req.header('x-cron-secret') ?? ''
  const expected = c.env.CRON_SECRET
  if (!expected || expected.length < 16) {
    return c.json({ error: 'Server misconfigured' }, 500)
  }

  if (!timingSafeEqual(secret, expected)) {
    return c.json({ error: 'Forbidden' }, 403)
  }

  const db = createDb(c.env)
  const deleted = await deleteOldWebhookDeliveryLogs(db, 90)
  return c.json({ ok: true, deleted }, 200)
})