import { NextResponse } from "next/server";

function getCookieSettings() {
  const isProduction = process.env.NODE_ENV === "production";

  return {
    httpOnly: true,
    sameSite: isProduction ? ("none" as const) : ("lax" as const),
    secure: isProduction,
    path: "/",
  };
}

export async function POST() {
  const response = NextResponse.json({ message: "Logout successful" });

  response.cookies.set({
    name: "auth_token",
    value: "",
    ...getCookieSettings(),
    maxAge: 0,
  });

  const FRONTEND_ORIGIN = process.env.FRONTEND_ORIGIN ?? "http://localhost:3000";
  response.headers.set("Access-Control-Allow-Origin", FRONTEND_ORIGIN);
  response.headers.set("Access-Control-Allow-Credentials", "true");

  return response;
}