pinkudex/app/api/backup/import/route.ts

import { NextRequest, NextResponse } from "next/server";
import path from "node:path";
import { assertLocalRequest } from "@/lib/api/localOnly";
import { importDatabaseTables } from "@/lib/backup/importDb";

// Strip absolute-path noise — only the basename is useful to the client
// and absolute paths leak filesystem layout to anything that pings the
// API on the local network.
const baseOnly = (p: string | null | undefined): string | null =>
  p ? path.basename(p) : null;

export const runtime = "nodejs";
export const dynamic = "force-dynamic";

export async function POST(req: NextRequest) {
  const blocked = assertLocalRequest(req);
  if (blocked) return blocked;

  let payload: { tables?: Record<string, unknown[]>; version?: number; app?: string };
  try {
    payload = await req.json();
  } catch {
    return NextResponse.json({ error: "Invalid JSON" }, { status: 400 });
  }

  const tables = payload.tables;
  if (!tables || typeof tables !== "object") {
    return NextResponse.json({ error: "Missing 'tables' object" }, { status: 400 });
  }
  if (!Array.isArray(tables.actresses) && !Array.isArray(tables.images)) {
    return NextResponse.json({ error: "Backup payload is missing core tables." }, { status: 400 });
  }

  const result = await importDatabaseTables(tables);
  const snapshotName = baseOnly(result.snapshotPath);
  if (!result.ok) {
    return NextResponse.json(
      {
        error: result.error,
        snapshotName,
        hint: snapshotName
          ? `Live DB rolled back. A pre-import snapshot was saved as ${snapshotName}.`
          : undefined,
      },
      { status: 500 },
    );
  }

  return NextResponse.json({
    ok: true,
    counts: result.counts,
    errors: result.errors,
    snapshotName,
  });
}