/api/auth/refresh (dashboard)

export async function POST(request: NextRequest): Promise<NextResponse> {
  // Rate limit: 20 refresh attempts per minute per IP
  const clientIp = getClientIp(request);
  if (!checkRateLimit(clientIp, 'refresh')) {
    return NextResponse.json(
      { error: 'rate_limited', error_description: 'Too many requests. Please try again later.' },
      { status: 429 }
    );
  }

  const cookieStore = await cookies();
  const refreshToken = cookieStore.get('l1fe_refresh_token')?.value;

  if (!refreshToken) {
    return NextResponse.json(
      { error: 'no_refresh_token', error_description: 'No refresh token available' },
      { status: 401 }
    );
  }

  const tokenUrl = `${SSO_URL}/v4/oauth/token`;
  const params: Record<string, string> = {
    grant_type: 'refresh_token',
    client_id: CLIENT_ID,
    refresh_token: refreshToken,
  };

  if (CLIENT_SECRET) {
    params.client_secret = CLIENT_SECRET;
  }

  try {
    const tokenResponse = await fetch(tokenUrl, {
      method: 'POST',
      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
      body: new URLSearchParams(params),
    });

    if (!tokenResponse.ok) {
      const errorData = await tokenResponse.json().catch(() => ({}));
      console.error('Token refresh failed:', errorData);

      // Clear invalid cookies
      const response = NextResponse.json(
        {
          error: (errorData as Record<string, string>).error || 'refresh_failed',
          error_description:
            (errorData as Record<string, string>).error_description ||
            'Token refresh failed',
        },
        { status: tokenResponse.status }
      );
      response.cookies.delete('l1fe_access_token');
      response.cookies.delete('l1fe_refresh_token');
      response.cookies.delete('l1fe_id_token');
      return response;
    }

    const tokens = await tokenResponse.json();
    const response = NextResponse.json({ refreshed: true });
    setAuthTokenCookies(response, tokens, process.env.NODE_ENV === 'production');
    return response;
  } catch (err) {
    console.error('Token refresh error:', err);
    return NextResponse.json(
      { error: 'internal_error', error_description: 'Failed to refresh token' },
      { status: 500 }
    );
  }
}

NextResponse.json(
      { error: 'rate_limited', error_description: 'Too many requests. Please try again later.' },
      { status: 429 }
    )

NextResponse.json(
      { error: 'no_refresh_token', error_description: 'No refresh token available' },
      { status: 401 }
    )

tokenResponse.json()

NextResponse.json(
        {
          error: (errorData as Record<string, string>).error || 'refresh_failed',
          error_description:
            (errorData as Record<string, string>).error_description ||
            'Token refresh failed',
        },
        { status: tokenResponse.status }
      )

tokenResponse.json()

NextResponse.json({ refreshed: true })

NextResponse.json(
      { error: 'internal_error', error_description: 'Failed to refresh token' },
      { status: 500 }
    )