import { NextRequest, NextResponse } from 'next/server';

interface RateLimitRecord {
  count: number;
  resetTime: number;
}

const tracker = new Map<string, RateLimitRecord>();

/**
 * Clean up expired rate limit entries every 5 minutes
 */
setInterval(() => {
  const now = Date.now();
  tracker.forEach((record, key) => {
    if (now > record.resetTime) {
      tracker.delete(key);
    }
  });
}, 300000);

/**
 * Basic in-memory rate limiter for auth routes
 * @param req NextRequest
 * @param limit Max allowed requests within window
 * @param windowMs Window in milliseconds (default 15 minutes)
 */
export function rateLimiter(
  req: NextRequest,
  limit: number = 20,
  windowMs: number = 15 * 60 * 1000
): NextResponse | null {
  const ip =
    req.headers.get('x-forwarded-for')?.split(',')[0].trim() ||
    req.headers.get('x-real-ip') ||
    '127.0.0.1';

  const path = req.nextUrl.pathname;
  const key = `${ip}:${path}`;
  const now = Date.now();

  const record = tracker.get(key);

  if (!record || now > record.resetTime) {
    tracker.set(key, { count: 1, resetTime: now + windowMs });
    return null;
  }

  record.count += 1;
  if (record.count > limit) {
    const retryAfter = Math.ceil((record.resetTime - now) / 1000);
    return NextResponse.json(
      {
        success: false,
        error: 'Too many requests. Please try again later.',
        retryAfterSeconds: retryAfter,
      },
      {
        status: 429,
        headers: {
          'Retry-After': String(retryAfter),
        },
      }
    );
  }

  return null;
}