import { NextResponse } from "next/server";
import { gatewayFetch } from "@/lib/api/gateway";

export const dynamic = "force-dynamic";

/** POST /api/auth/password-reset  — request a password reset OTP email */
export async function POST(request: Request) {
  let body: unknown;
  try { body = await request.json(); } catch {
    return NextResponse.json({ error: "Invalid JSON" }, { status: 400 });
  }
  const { email } = body as { email?: string };
  if (!email) return NextResponse.json({ error: "email required" }, { status: 400 });

  const res = await gatewayFetch("/v1/auth/password/reset/request", {
    method: "POST",
    body: JSON.stringify({ email }),
  });
  // Always return 200 to avoid user enumeration
  if (!res.ok && res.status !== 404) {
    return NextResponse.json({ error: "Request failed" }, { status: 500 });
  }
  return NextResponse.json({ ok: true });
}
