import { NextResponse } from 'next/server';
export const ACCESS_COOKIE='meshkee_customer_access_token';
export const REFRESH_COOKIE='meshkee_customer_refresh_token';
export function cookieOptions(request:Request){
 const host=(request.headers.get('host')||'').split(':')[0];
 const production=host==='sgemed.com'||host.endsWith('.sgemed.com');
 return {path:'/',httpOnly:true,sameSite:'lax' as const,secure:production||new URL(request.url).protocol==='https:',...(production?{domain:'.sgemed.com'}:{})};
}
export function setSessionCookies(response:NextResponse,request:Request,tokens:{accessToken:string;refreshToken:string}){
 // Session lifetime remains controlled by the backend; never infer claims from an unverified JWT.
 const options=cookieOptions(request);
 response.cookies.set(ACCESS_COOKIE,tokens.accessToken,options);
 response.cookies.set(REFRESH_COOKIE,tokens.refreshToken,options);
}
export function sameOrigin(request:Request){
 const origin=request.headers.get('origin');
 if(!origin)return false;
 try{return new URL(origin).host===request.headers.get('host')}catch{return false}
}