// api/schedule.ts — Vercel serverless
import type { VercelRequest, VercelResponse } from '@vercel/node';

export default async function handler(req: VercelRequest, res: VercelResponse) {
  if (req.method !== 'POST') return res.status(405).end();

  // Get token from persistent store (not env var — tokens rotate)
  const token = await getStoredToken();

  const response = await fetch('https://platform.hootsuite.com/v1/messages', {
    method: 'POST',
    headers: { 'Authorization': `Bearer ${token}`, 'Content-Type': 'application/json' },
    body: JSON.stringify(req.body),
  });

  const result = await response.json();
  res.json(result);
}

vercel env add HOOTSUITE_CLIENT_ID production
vercel env add HOOTSUITE_CLIENT_SECRET production
vercel --prod

// Use Redis, database, or KV store for token persistence
// Tokens refresh every ~1 hour and refresh_token changes each time
import { kv } from '@vercel/kv';

async function getStoredToken(): Promise<string> {
  let token = await kv.get('hootsuite:access_token');
  const expiresAt = await kv.get('hootsuite:expires_at') as number;

  if (!token || Date.now() > expiresAt - 60000) {
    const refreshToken = await kv.get('hootsuite:refresh_token') as string;
    const newTokens = await refreshHootsuiteToken(refreshToken);
    await kv.set('hootsuite:access_token', newTokens.access_token);
    await kv.set('hootsuite:refresh_token', newTokens.refresh_token);
    await kv.set('hootsuite:expires_at', Date.now() + newTokens.expires_in * 1000);
    token = newTokens.access_token;
  }
  return token as string;
}