import { NextRequest, NextResponse } from 'next/server';

export const dynamic = 'force-dynamic';

const BACKEND_URL = process.env.BACKEND_URL || 'http://localhost:3000';

/**
 * Public profile proxy (A1 Session 10) — forwards GET /api/profiles/:handle.
 * Express owns the privacy rules: unpublished and unknown handles come back
 * as the SAME 404 body (no existence leak) — this proxy passes it through
 * untouched.
 */
export async function GET(
  req: NextRequest,
  { params }: { params: Promise<{ handle: string }> },
) {
  const { handle } = await params;
  try {
    const upstream = await fetch(`${BACKEND_URL}/api/profiles/${encodeURIComponent(handle)}`, {
      headers: { Accept: 'application/json' },
      cache: 'no-store',
    });
    const data = await upstream.json().catch(() => ({ error: 'Profile not found' }));
    return NextResponse.json(data, {
      status: upstream.status,
      headers: upstream.ok ? { 'Cache-Control': 'public, s-maxage=60, stale-while-revalidate=120' } : undefined,
    });
  } catch {
    return NextResponse.json({ error: 'Profile not found' }, { status: 404 });
  }
}
