Season Rotation

export async function POST(request, { params }) {
  const authHeader = request.headers.get("x-edge-auth")
  if (authHeader !== process.env.EDGE_API_SECRET) {
    return new Response("Unauthorized", { status: 401 })
  }

  const { encryptedSession } = params
  const token = await decrypt(encryptedSession)
  const session = await getSessionByToken(token)

  if (!session || session.expiresAt < new Date()) {
    return Response.json({ error: "Session expired" }, { status: 401 })
  }

  const shouldRotate = (new Date(session.expiresAt) - Date.now()) < ONE_DAY_MS

  if (!shouldRotate) return Response.json({})

  // Rotate token
  const newToken = generateToken(64)
  const newExpiry = new Date(Date.now() + ONE_DAY_MS)

  await createSession(session.userId, newExpiry, newToken)
  await deleteSession(token)

  const newEncryptedSession = await encrypt(newToken)

  return Response.json({ newSession: newEncryptedSession, expiresAt: newExpiry })
}