import { NextResponse } from "next/server";
import { query, queryOne } from "@/lib/db";
import { requireSession, UnauthorizedError } from "@/lib/auth/session";
import { isSameOrigin } from "@/lib/origin";

// Nimmt bewusst NUR full_name/password_auth_enabled aus dem Body an –
// ersetzt den früheren Postgres-Column-Grant, der self-service-Updates
// auf "role"/"email" verhindert hat. Ein generisches "update the whole
// body"-Endpoint würde diese Absicherung wieder aufheben.
export async function PATCH(request: Request) {
  if (!isSameOrigin(request)) {
    return NextResponse.json({ error: "Nicht erlaubt." }, { status: 403 });
  }
  try {
    const session = await requireSession();
    const body = (await request.json().catch(() => ({}))) as {
      full_name?: string;
      password_auth_enabled?: boolean;
    };

    if (body.password_auth_enabled === false) {
      const passkeys = await queryOne<{ count: string }>(
        "select count(*)::int as count from passkey_credentials where user_id = $1",
        [session.user.id]
      );
      if (!passkeys || Number(passkeys.count) === 0) {
        return NextResponse.json({ error: "needs_passkey" }, { status: 400 });
      }
    }

    if (body.full_name !== undefined) {
      const name = body.full_name.trim();
      if (!name) return NextResponse.json({ error: "name_required" }, { status: 400 });
      await query("update users set full_name = $1 where id = $2", [name, session.user.id]);
    }
    if (body.password_auth_enabled !== undefined) {
      await query("update users set password_auth_enabled = $1 where id = $2", [
        body.password_auth_enabled,
        session.user.id,
      ]);
    }

    return NextResponse.json({ ok: true });
  } catch (err) {
    if (err instanceof UnauthorizedError) {
      return NextResponse.json({ error: "unauthorized" }, { status: 401 });
    }
    throw err;
  }
}