import type { Handle } from '@sveltejs/kit';

// Reverse-proxy `/api/*` requests through to the backend container.
//
// Mangalord's compose runs SvelteKit (this process) on :3000 and axum on
// :8080. The browser only ever talks to :3000, so cookies stay
// same-origin and `CORS_ALLOWED_ORIGINS` can stay empty in the default
// deploy. The backend hostname comes from `BACKEND_URL` (compose wires
// `http://backend:8080`); for `npm run dev` we fall back to the same
// localhost target the vite proxy uses, which keeps the dev story
// consistent even if someone bypasses the vite proxy.

const BACKEND_URL = process.env.BACKEND_URL ?? 'http://localhost:8080';

export const handle: Handle = async ({ event, resolve }) => {
    if (event.url.pathname.startsWith('/api/')) {
        const target = `${BACKEND_URL}${event.url.pathname}${event.url.search}`;

        // Strip hop-by-hop headers — `host` would mislead the backend
        // about the origin, and `content-length` will be recomputed.
        const headers = new Headers(event.request.headers);
        headers.delete('host');
        headers.delete('content-length');

        const init: RequestInit & { duplex?: 'half' } = {
            method: event.request.method,
            headers,
            redirect: 'manual'
        };
        if (event.request.method !== 'GET' && event.request.method !== 'HEAD') {
            init.body = event.request.body;
            // Node's fetch requires `duplex: 'half'` when streaming a
            // request body; otherwise the stream is rejected.
            init.duplex = 'half';
        }

        const upstream = await fetch(target, init);
        return new Response(upstream.body, {
            status: upstream.status,
            statusText: upstream.statusText,
            headers: upstream.headers
        });
    }
    return resolve(event);
};