import { Router } from "express";
import { z } from "zod";
import { prisma } from "../prisma.js";
import { env } from "../env.js";
import { HttpError } from "../lib/http-error.js";
import { verifyPassword } from "../lib/password.js";
import {
  AUTH_COOKIE_MAX_AGE_MS,
  AUTH_COOKIE_NAME,
  signAuthToken,
} from "../lib/jwt.js";
import { loginRateLimiter } from "../middleware/rate-limit.js";
import { requireAuth } from "../middleware/auth.js";

export const authRouter = Router();

const loginSchema = z.object({
  username: z.string().min(1).max(50),
  password: z.string().min(1).max(200),
});

const INVALID_CREDENTIALS = "Credenciales inválidas";

authRouter.post("/login", loginRateLimiter, async (req, res, next) => {
  try {
    const { username, password } = loginSchema.parse(req.body);

    const user = await prisma.user.findUnique({ where: { username } });
    if (!user || !user.active) throw new HttpError(401, INVALID_CREDENTIALS);

    const ok = await verifyPassword(password, user.passwordHash);
    if (!ok) throw new HttpError(401, INVALID_CREDENTIALS);

    const token = signAuthToken({ sub: user.id, username: user.username });

    await prisma.user.update({
      where: { id: user.id },
      data: { lastLoginAt: new Date() },
    });

    res.cookie(AUTH_COOKIE_NAME, token, {
      httpOnly: true,
      secure: env.NODE_ENV === "production",
      sameSite: "lax",
      path: "/",
      maxAge: AUTH_COOKIE_MAX_AGE_MS,
      domain: env.COOKIE_DOMAIN === "localhost" ? undefined : env.COOKIE_DOMAIN,
    });

    res.json({
      user: { id: user.id, username: user.username, name: user.name },
    });
  } catch (err) {
    next(err);
  }
});

authRouter.post("/logout", (_req, res) => {
  res.clearCookie(AUTH_COOKIE_NAME, { path: "/" });
  res.json({ ok: true });
});

authRouter.get("/me", requireAuth, (req, res) => {
  res.json({ user: req.user });
});