import { NextResponse } from "next/server";
import { db } from "@/lib/db";

function isAuthorized(req: Request): boolean {
  const key = process.env.DISPLAY_API_KEY;
  if (!key) return false; // key must be set
  return req.headers.get("x-display-key") === key;
}

export async function GET(req: Request) {
  if (!isAuthorized(req)) {
    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
  }

  const { searchParams } = new URL(req.url);
  const after = parseInt(searchParams.get("after") ?? "0", 10);

  // Prune events older than 24 h — fire and forget
  db.displayEvent
    .deleteMany({ where: { createdAt: { lt: new Date(Date.now() - 86_400_000) } } })
    .catch(() => {});

  const events = await db.displayEvent.findMany({
    where: { id: { gt: after } },
    orderBy: { id: "asc" },
    take: 10,
    select: { id: true, type: true, shotCode: true, by: true },
  });

  return NextResponse.json(events);
}