import { createHash } from "crypto";

import { sql } from "@/lib/db";
import { hashPassword } from "@/lib/password";
import { issueSession, toProfile } from "@/lib/users";

const hashCode = (email: string, code: string): string =>
  createHash("sha256").update(`${email}:${code}`).digest("hex");

export async function POST(req: Request) {
  const { email, code, password } = await req.json();

  if (!email?.trim() || !/^\d{6}$/.test(code ?? "")) {
    return Response.json(
      { error: "Email and a 6-digit code are required." },
      { status: 400 },
    );
  }

  if (typeof password !== "string" || password.length < 8) {
    return Response.json(
      { error: "Password must be at least 8 characters." },
      { status: 400 },
    );
  }

  const normalized = email.trim().toLowerCase();

  try {
    const valid = await sql<{ email: string }>`
      SELECT email FROM password_reset_codes
      WHERE email = ${normalized}
        AND code_hash = ${hashCode(normalized, code)}
        AND expires_at > CURRENT_TIMESTAMP
    `;

    if (!valid[0]) {
      await sql`
        UPDATE password_reset_codes SET attempts = attempts + 1
        WHERE email = ${normalized}
      `;

      return Response.json(
        { error: "Invalid or expired reset code." },
        { status: 400 },
      );
    }

    // A successful reset also proves control of the mailbox, so verify it too.
    const rows = await sql<{
      id: string;
      name: string;
      email: string;
      role: string | null;
    }>`
      UPDATE users
      SET password_hash = ${hashPassword(password)}, email_verified = TRUE
      WHERE email = ${normalized}
      RETURNING id, name, email, role
    `;

    const user = rows[0];

    if (!user) {
      return Response.json({ error: "User not found." }, { status: 404 });
    }

    await sql`DELETE FROM password_reset_codes WHERE email = ${normalized}`;

    const session = issueSession(user);

    return Response.json({
      data: { token: session.token, user: toProfile(user) },
    });
  } catch (error) {
    console.error("[RESET_PASSWORD]: ", error);
    return Response.json({ error: "Internal Server Error" }, { status: 500 });
  }
}