import { canCompany, companyPermissions } from "@/lib/company-context";
import { requireApiV1Auth } from "@/lib/api-v1/auth";
import { apiJsonOk, toApiErrorResponse } from "@/lib/api-v1/response";
import { applyApiRateLimit } from "@/lib/api-v1/rate-limit";

export async function GET(request: Request) {
  try {
    const auth = await requireApiV1Auth(request);
    const rateLimit = applyApiRateLimit(
      request,
      {
        namespace: "api-v1:auth:me",
        windowMs: 60_000,
        maxPerIp: 120,
        maxPerUser: 120,
      },
      auth.user.id
    );
    const { user, companyContext } = auth;
    return apiJsonOk(
      {
      user: {
        id: user.id,
        email: user.email || null,
      },
      company: {
        id: companyContext.companyId,
        owner_id: companyContext.ownerId,
        tenant_ids: companyContext.tenantIds,
        permissions: companyPermissions.filter((permission) => canCompany(companyContext, user.id, permission)),
      },
      },
      { headers: rateLimit.headers }
    );
  } catch (error) {
    return toApiErrorResponse(error);
  }
}