import { NextResponse } from "next/server"
import { isAuthorizedCron } from "@/lib/cron-auth"
import { processDueDeletions } from "@/lib/gdpr/delete"

// GDPR deletion drain: hard-deletes accounts whose grace period
// (LEGAL.dataDeletionDays after the request) has elapsed. Scheduled daily via
// DigitalOcean Functions — see functions/project.yml.
export async function GET(request: Request) {
  if (!isAuthorizedCron(request)) {
    return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
  }

  const { processed, deleted } = await processDueDeletions(25)
  return NextResponse.json({ processed, deleted })
}