import { NextResponse } from "next/server";
import prisma from "@/lib/prisma";
import { hashPassword } from "@/lib/password";

export async function POST(req: Request) {
  const { token, password } = await req.json();
  if (!token || !password) return NextResponse.json({ error: "invalid" }, { status: 400 });
  const prt = await prisma.passwordResetToken.findUnique({ where: { token } });
  if (!prt || prt.usedAt || prt.expiresAt < new Date()) {
    return NextResponse.json({ error: "expired or used" }, { status: 400 });
  }
  await prisma.$transaction([
    prisma.user.update({ where: { userId: prt.userId }, data: { passwordHash: hashPassword(password) } }),
    prisma.passwordResetToken.update({ where: { token }, data: { usedAt: new Date() } }),
  ]);
  return NextResponse.json({ ok: true });
}


