import { NextRequest, NextResponse } from "next/server";
import { addServer, listServers } from "@/lib/server/xtreamServers";

export const dynamic = "force-dynamic";

// Clave del panel admin (ponla en el VPS: ARVIO_ADMIN_KEY). Default para pruebas.
function adminOk(req: NextRequest): boolean {
  const key = process.env.ARVIO_ADMIN_KEY || "admin123";
  return (req.headers.get("x-admin-key") || "") === key;
}

export async function GET(req: NextRequest) {
  if (!adminOk(req)) return NextResponse.json({ error: "No autorizado" }, { status: 401 });
  return NextResponse.json({ servers: await listServers() });
}

export async function POST(req: NextRequest) {
  if (!adminOk(req)) return NextResponse.json({ error: "No autorizado" }, { status: 401 });
  const body = await req.json().catch(() => ({}));
  const url = String(body.url ?? "").trim();
  if (!/^https?:\/\//i.test(url)) {
    return NextResponse.json({ error: "La URL debe empezar con http:// o https://" }, { status: 400 });
  }
  const srv = await addServer(url, String(body.label ?? ""));
  return NextResponse.json({ server: srv });
}