import {env} from 'cloudflare:workers';
const admin=(r:Request)=>!!(env as any).ADMIN_PASSWORD&&r.headers.get('authorization')===`Bearer ${(env as any).ADMIN_PASSWORD}`;
export async function GET(r:Request){const full=new URL(r.url).searchParams.has('admin');if(full&&!admin(r))return Response.json({message:'Acceso no autorizado'},{status:401});const result=await env.DB.prepare(full?'SELECT * FROM comments ORDER BY id DESC LIMIT 100':'SELECT id,name,body FROM comments WHERE status = ? ORDER BY id DESC LIMIT 30').bind(...(full?[]:['approved'])).all();return Response.json(result.results,{headers:{'Cache-Control':'no-store'}});}
export async function POST(r:Request){if(r.headers.get('origin')!==new URL(r.url).origin)return Response.json({message:'Origen no permitido'},{status:403});try{const b=await r.json() as any;if(b.website||typeof b.name!=='string'||b.name.trim().length<2||b.name.length>60||typeof b.body!=='string'||b.body.trim().length<10||b.body.length>1500)return Response.json({message:'Revisa el nombre y el comentario (10 a 1500 caracteres).'},{status:400});const c=await env.DB.prepare('DELETE FROM challenges WHERE id=? AND expires>? RETURNING answer').bind(String(b.challengeId),Date.now()).first() as any;if(!c||Number(b.answer)!==c.answer)return Response.json({message:'La verificación es incorrecta o ha caducado. Inténtalo con la nueva suma.'},{status:400});await env.DB.prepare('INSERT INTO comments (name,body,status,created) VALUES (?,?,?,?)').bind(b.name.trim(),b.body.trim(),'pending',new Date().toISOString()).run();return Response.json({message:'Gracias. Tu comentario está pendiente de aprobación.'});}catch{return Response.json({message:'No se pudo enviar. Inténtalo nuevamente.'},{status:400});}}
export async function PATCH(r:Request){if(!admin(r))return Response.json({message:'Acceso no autorizado'},{status:401});const b=await r.json() as any;if(!['approved','rejected','pending'].includes(b.status)||!Number.isInteger(b.id))return Response.json({message:'Datos no válidos'},{status:400});await env.DB.prepare('UPDATE comments SET status=? WHERE id=?').bind(b.status,b.id).run();return Response.json({ok:true});}