class Api::V1::LeaderboardController < ApplicationController
  skip_before_action :verify_authenticity_token
  skip_before_action :authenticate

  ACCESS_TOKEN = "ikea-tomato-2026"

  before_action :set_cors_headers, :set_locale_to_default, :verify_access_token

  def index
    request.format = :json

    data = Rails.cache.fetch("api/v1/leaderboard", expires_in: 1.minute) do
      DemoActivity.simulate! # TEMP: fake gameplay so the banner has moving numbers
      leaderboard = LeaderboardScore.call
      {
        leaderboard: leaderboard,
        badges:      LeaderboardBadges.call(leaderboard),
        updated_at:  Time.current
      }
    end

    @leaderboard = data[:leaderboard]
    @badges = data[:badges]
    @updated_at = data[:updated_at]
  end

  private

  def set_locale_to_default
    I18n.locale = I18n.default_locale
  end


  def verify_access_token
    unless request.headers["Authorization"] == "Bearer #{ACCESS_TOKEN}"
      render json: { error: "Unauthorized" }, status: :unauthorized
    end
  end

  def set_cors_headers
    response.headers["Access-Control-Allow-Origin"] = "*"
  end
end