Backend for Frontend (BFF)

// app/api/dashboard/route.ts  (Next.js 16, App Router)
import { cookies } from "next/headers";
import { NextResponse } from "next/server";

const INTERNAL = process.env.INTERNAL_API_BASE!; // never reaches the browser

export async function GET() {
  const session = (await cookies()).get("session")?.value;
  if (!session) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });

  // Exchange session cookie for a short-lived service token
  const tokenRes = await fetch(`${INTERNAL}/auth/exchange`, {
    method: "POST",
    headers: { "x-session": session },
    cache: "no-store",
  });
  const { token } = await tokenRes.json();

  const headers = { Authorization: `Bearer ${token}` };

  // Fan out to three services in parallel
  const [user, orders, recs] = await Promise.all([
    fetch(`${INTERNAL}/users/me`, { headers }).then((r) => r.json()),
    fetch(`${INTERNAL}/orders?limit=5`, { headers }).then((r) => r.json()),
    fetch(`${INTERNAL}/recs?context=dashboard`, { headers }).then((r) => r.json()),
  ]);

  // Return exactly the shape the dashboard component needs
  return NextResponse.json({ user, orders: orders.items, recs: recs.items });
}