import { NextResponse } from "next/server";
import { checkRateLimit } from "@/lib/rate-limit";

export function assertSameOrigin(request: Request) {
  const origin = request.headers.get("origin");
  const host = request.headers.get("host");

  if (!origin || !host) {
    return null;
  }

  try {
    const originUrl = new URL(origin);

    if (originUrl.host !== host) {
      return NextResponse.json({ message: "Origem nao autorizada." }, { status: 403 });
    }
  } catch {
    return NextResponse.json({ message: "Origem invalida." }, { status: 403 });
  }

  return null;
}

export function rateLimitResponse(key: string, limit = 10, windowMs = 15 * 60 * 1000) {
  const result = checkRateLimit(key, limit, windowMs);

  if (!result.allowed) {
    return NextResponse.json({ message: "Muitas tentativas. Tente novamente mais tarde." }, { status: 429 });
  }

  return null;
}