// CostModel.co.uk — Cloudflare Worker
// 1. Paste into Cloudflare Worker editor → Deploy
// 2. Worker → Settings → Variables → add ANTHROPIC_KEY + WORKER_TOKEN (both encrypted)
// 3. Copy Worker URL → paste into Global Worker URL above + append /api/claude

const CORS = {
  'Access-Control-Allow-Origin': '*',
  'Access-Control-Allow-Methods': 'GET, POST, OPTIONS',
  'Access-Control-Allow-Headers': 'Content-Type, X-Worker-Token',
};

export default {
  async fetch(request, env) {
    if (request.method === 'OPTIONS') return new Response(null, { headers: CORS });
    const url = new URL(request.url);
    const path = url.pathname;

    if (path !== '/api/health') {
      const token = request.headers.get('X-Worker-Token');
      if (env.WORKER_TOKEN && token !== env.WORKER_TOKEN)
        return new Response('Unauthorized', { status: 401 });
    }

    if (path === '/api/health')
      return new Response(JSON.stringify({ ok: true, service: 'CostModel.co.uk Worker' }),
        { headers: { 'Content-Type': 'application/json', ...CORS } });

    if (path === '/api/claude' && request.method === 'POST') {
      const body = await request.json();
      const resp = await fetch('https://api.anthropic.com/v1/messages', {
        method: 'POST',
        headers: { 'Content-Type': 'application/json', 'x-api-key': env.ANTHROPIC_KEY, 'anthropic-version': '2023-06-01' },
        body: JSON.stringify({ model: body.model || 'claude-sonnet-4-20250514', max_tokens: Math.min(body.max_tokens || 6000, 8000), system: body.system, messages: body.messages }),
      });
      const data = await resp.json();
      return new Response(JSON.stringify(data), { headers: { 'Content-Type': 'application/json', ...CORS } });
    }

    if (path === '/api/send-otp' && request.method === 'POST') {
      const { email, code, fromEmail, fromName } = await request.json();
      await fetch('https://api.mailchannels.net/tx/v1/send', {
        method: 'POST', headers: { 'Content-Type': 'application/json' },
        body: JSON.stringify({
          personalizations: [{ to: [{ email }] }],
          from: { email: fromEmail || 'noreply@costmodel.co.uk', name: fromName || 'CostModel.co.uk' },
          subject: 'Your CostModel.co.uk sign-in code',
          content: [{ type: 'text/html', value: '<div style="font-family:sans-serif;max-width:520px;margin:0 auto;padding:20px"><h2 style="color:#185FA5">Your sign-in code</h2><p>Use this code to sign in to CostModel.co.uk:</p><div style="font-size:36px;font-weight:800;letter-spacing:8px;color:#4F46E5;background:#EEF2FF;padding:16px;text-align:center;border-radius:8px;margin:16px 0">' + code + '</div><p style="color:#888;font-size:12px">Expires in 10 minutes. If you did not request this, ignore this email.</p><p style="font-size:11px;color:#aaa;margin-top:16px">© 2025 CostModel.co.uk</p></div>' }]
        }),
      });
      return new Response(JSON.stringify({ ok: true }), { headers: { 'Content-Type': 'application/json', ...CORS } });
    }

    return new Response('Not found', { status: 404 });
  }
};