import { NextResponse } from "next/server";
import { loginSchema } from "@/lib/validation/auth";
import { LOGIN_ERROR_MESSAGES, login } from "@/server/auth/login-service";
import { readSessionCookie, setSessionCookie } from "@/server/auth/session-cookie";
import { jsonError } from "@/server/http/api-auth";
import { metaFromHeaders } from "@/server/http/request-meta";
import { isSameOriginRequest } from "@/server/http/same-origin";

/**
 * Login por API (mismo servicio que el formulario). Pensado para clientes del propio sitio:
 * exige Origin del sitio y responde con la cookie HttpOnly, nunca con el token en el cuerpo.
 */
export async function POST(request: Request): Promise<NextResponse> {
  if (!isSameOriginRequest(request)) return jsonError(403, "Origen no permitido");

  let body: unknown;
  try {
    body = await request.json();
  } catch {
    return jsonError(400, "JSON inválido");
  }

  const parsed = loginSchema.safeParse(body);
  if (!parsed.success) return jsonError(400, "Datos inválidos");

  const meta = metaFromHeaders(request.headers);
  const result = await login({
    email: parsed.data.email,
    password: parsed.data.password,
    ip: meta.ip,
    userAgent: meta.userAgent,
    currentToken: await readSessionCookie(),
  });

  if (!result.ok) {
    return jsonError(result.code === "RATE_LIMITED" ? 429 : 401, LOGIN_ERROR_MESSAGES[result.code]);
  }

  await setSessionCookie(result.token, result.expiresAt);
  return NextResponse.json(
    { ok: true, mustChangePassword: result.mustChangePassword },
    { headers: { "Cache-Control": "no-store" } },
  );
}