import { NextResponse } from "next/server";
import { queryOne } from "@/lib/db";
import { verifyPassword } from "@/lib/auth/password";
import { createSession } from "@/lib/auth/session";
import { isSameOrigin } from "@/lib/origin";
import type { Role } from "@/lib/types";

export async function POST(request: Request) {
  if (!isSameOrigin(request)) {
    return NextResponse.json({ error: "Nicht erlaubt." }, { status: 403 });
  }

  const { email, password } = (await request.json().catch(() => ({}))) as {
    email?: string;
    password?: string;
  };
  if (!email || !password) {
    return NextResponse.json({ error: "invalid_credentials" }, { status: 400 });
  }

  const user = await queryOne<{
    id: string;
    password_hash: string;
    role: Role;
    password_auth_enabled: boolean;
  }>(
    "select id, password_hash, role, password_auth_enabled from users where email = $1",
    [email.trim().toLowerCase()]
  );

  if (!user || !verifyPassword(password, user.password_hash)) {
    return NextResponse.json({ error: "invalid_credentials" }, { status: 401 });
  }
  if (!user.password_auth_enabled) {
    return NextResponse.json({ error: "password_disabled" }, { status: 403 });
  }

  await createSession(user.id);
  return NextResponse.json({ role: user.role });
}