import { NextResponse } from "next/server";
import { loginSchema } from "@/lib/validation/auth";
import prisma from "@/lib/prisma";
import { verifyPassword } from "@/lib/password";
import { getClientKey, isRateLimited } from "@/lib/ratelimit";

export async function GET(req: Request) {
  try {
    const cookieHeader = req.headers.get("cookie") || "";
    const uid = cookieHeader
      .split(";")
      .map((s) => s.trim())
      .find((pair) => pair.startsWith("uid="))
      ?.split("=")[1];
    if (!uid) return NextResponse.json({ ok: false }, { status: 200 });
    const user = await prisma.user.findUnique({ where: { userId: decodeURIComponent(uid) } });
    if (!user) return NextResponse.json({ ok: false }, { status: 200 });
    return NextResponse.json({ ok: true, user: { userId: user.userId, nickname: user.nickname } });
  } catch {
    return NextResponse.json({ ok: false }, { status: 200 });
  }
}

export async function POST(req: Request) {
  const key = getClientKey(req, "login");
  if (isRateLimited(key, 5, 60_000)) {
    return NextResponse.json({ error: "Too Many Requests" }, { status: 429 });
  }
  const body = await req.json();
  const parsed = loginSchema.safeParse(body);
  if (!parsed.success)
    return NextResponse.json(
      { error: "아이디 또는 비밀번호가 일치하지 않습니다" },
      { status: 401 }
    );
  const { id, password } = parsed.data;
  // DB에서는 로그인 아이디를 nickname 컬럼으로 보관
  const user = await prisma.user.findUnique({ where: { nickname: id } });
  if (!user || !user.passwordHash || !verifyPassword(password, user.passwordHash)) {
    return NextResponse.json(
      { error: "아이디 또는 비밀번호가 일치하지 않습니다" },
      { status: 401 }
    );
  }
  // 사용자의 관리자 권한 여부 확인
  let isAdmin = false;
  const userRoles = await prisma.userRole.findMany({
    where: { userId: user.userId },
    select: { roleId: true },
  });
  if (userRoles.length > 0) {
    const roleIds = userRoles.map((r) => r.roleId);
    const hasAdmin = await prisma.rolePermission.findFirst({
      where: {
        roleId: { in: roleIds },
        resource: "ADMIN",
        action: "ADMINISTER",
        allowed: true,
      },
      select: { id: true },
    });
    isAdmin = !!hasAdmin;
  }
  // 추가 안전장치: 사용자 레코드의 authLevel이 ADMIN이면 관리자 취급
  if (!isAdmin && user.authLevel === "ADMIN") {
    isAdmin = true;
  }

  const res = NextResponse.json({ ok: true, user: { userId: user.userId, nickname: user.nickname } });
  // HTTPS 요청에서만 Secure 속성 부여 (HTTP 환경에서는 생략하여 로컬 start에서도 동작)
  let secureAttr = "";
  try {
    const isHttps = new URL(req.url).protocol === "https:";
    secureAttr = isHttps ? "; Secure" : "";
  } catch {
    secureAttr = "";
  }
  res.headers.append(
    "Set-Cookie",
    `uid=${encodeURIComponent(user.userId)}; Path=/; HttpOnly; SameSite=Lax${secureAttr}`
  );
  res.headers.append(
    "Set-Cookie",
    `isAdmin=${isAdmin ? "1" : "0"}; Path=/; HttpOnly; SameSite=Lax${secureAttr}`
  );
  return res;
}

export async function DELETE() {
  const res = NextResponse.json({ ok: true });
  res.headers.append("Set-Cookie", `uid=; Path=/; Max-Age=0; HttpOnly; SameSite=Lax`);
  res.headers.append("Set-Cookie", `isAdmin=; Path=/; Max-Age=0; HttpOnly; SameSite=Lax`);
  return res;
}


