frontend/app/api/login/route.ts

import { type NextRequest, NextResponse } from "next/server";
import {
  appSessionToken,
  setAppSessionCookie,
  verifyAppCredentials,
} from "@/lib/app-auth";

export const dynamic = "force-dynamic";
export const runtime = "nodejs";

function isHttps(request: NextRequest) {
  const forwardedProto = request.headers.get("x-forwarded-proto")?.split(",")[0]?.trim();
  return request.nextUrl.protocol === "https:" || forwardedProto === "https";
}

export async function POST(request: NextRequest) {
  const body = await request.json().catch(() => null);
  const username = typeof body?.username === "string" ? body.username : "";
  const password = typeof body?.password === "string" ? body.password : "";

  if (!(await verifyAppCredentials(username, password))) {
    return NextResponse.json({ detail: "Invalid username or password." }, { status: 401 });
  }

  const response = NextResponse.json({ ok: true });
  setAppSessionCookie(response.headers, await appSessionToken(), isHttps(request));
  return response;
}