import { NextResponse } from "next/server";
import { erpExportAuthorized, erpInvoicePdf, isInvoiceNumber } from "@/lib/erp-export";
import { rateLimit, getClientIp } from "@/lib/rate-limit";

const FAILED_ATTEMPTS_PER_WINDOW = 20;
const FAILED_WINDOW_MS = 15 * 60 * 1000;

/** Rechnungs-PDF fuer ERPNext (Anhang an der Ausgangsrechnung). Nur mit ERP_EXPORT_TOKEN. */
export async function GET(request: Request, { params }: { params: Promise<{ invoiceNumber: string }> }) {
  if (!erpExportAuthorized(request.headers.get("authorization"))) {
    const ip = await getClientIp();
    const status = rateLimit(`erp-export:${ip}`, FAILED_ATTEMPTS_PER_WINDOW, FAILED_WINDOW_MS) ? 401 : 429;
    return NextResponse.json({ error: "Nicht berechtigt." }, { status });
  }
  const { invoiceNumber } = await params;
  const pdf = isInvoiceNumber(invoiceNumber) ? await erpInvoicePdf(invoiceNumber) : null;
  if (!pdf) {
    return NextResponse.json({ error: "Rechnung nicht gefunden." }, { status: 404 });
  }
  return new NextResponse(new Uint8Array(pdf), {
    headers: {
      "Content-Type": "application/pdf",
      "Content-Disposition": `attachment; filename="${invoiceNumber}.pdf"`,
      "Cache-Control": "no-store",
    },
  });
}