import { getServerSession } from 'next-auth'
import { NextResponse } from 'next/server'
import { authOptions } from '@/lib/auth'
import { canViewPerformanceSalary } from '@/lib/performance-salary-access'

export const runtime = 'nodejs'
export const dynamic = 'force-dynamic'

export async function GET() {
  let canViewSalary = false
  try {
    const session = await getServerSession(authOptions)
    if (session?.user?.canAccessBrandCenter === true) {
      canViewSalary = await canViewPerformanceSalary(session.user.id)
    }
  } catch {
    // A failed permission check must never reveal a restricted navigation entry.
    canViewSalary = false
  }
  return NextResponse.json(
    { canViewPerformanceSalary: canViewSalary },
    { headers: { 'Cache-Control': 'private, no-store' } },
  )
}