import type { APIEvent } from "@solidjs/start/server";
import { env } from "~/env/server";
import { ConnectionFactory } from "~/server/db-connections";
import { runRetentionCron } from "~/server/analytics-retention";

/**
 * GET /api/analytics-retention — daily Vercel cron.
 *
 * Deletes `VisitorAnalytics` rows older than the retention window, so visitor
 * data has a bound instead of accumulating forever (FRE-369, finding Q4 — the
 * table's only cleaner used to be a manual admin call, and since FRE-366 the
 * rows carry a truncated but still real client address).
 *
 * Window: `ANALYTICS_RETENTION_DAYS`, defaulting to 365 when unset or unusable
 * (see `~/server/analytics-retention` for why the default is conservative
 * rather than the reviewer's 90).
 *
 * Auth: `Authorization: Bearer <secret>` where the secret is
 * `ANALYTICS_RETENTION_SECRET` or Vercel's `CRON_SECRET`. An unconfigured secret
 * denies every request — an unauthenticated trigger of a bulk delete is the one
 * outcome this endpoint must never have.
 */
export async function GET(event: APIEvent) {
  const result = await runRetentionCron({
    authorization: event.request.headers.get("authorization"),
    secret: env.ANALYTICS_RETENTION_SECRET ?? env.CRON_SECRET,
    configuredDays: env.ANALYTICS_RETENTION_DAYS,
    conn: ConnectionFactory()
  });

  return new Response(JSON.stringify(result.body), {
    status: result.status,
    headers: { "Content-Type": "application/json" }
  });
}