import { createError, getRequestHost, getRequestProtocol, readBody, setResponseStatus } from "h3"
import type { H3Event } from "h3"
import { issuePasswordResetToken } from "~/server/utils/auth"
import { sendAuthEmail } from "~/server/utils/email"
import { prisma } from "~/server/utils/prisma"

interface ForgotPasswordBody {
  email?: string
}

const normalizeEmail = (value: string) => value.trim().toLowerCase()

const getResetBaseUrl = (event: H3Event) => {
  const configuredBaseUrl = process.env.AUTH_RESET_BASE_URL?.trim()

  if (configuredBaseUrl) {
    return configuredBaseUrl.replace(/\/$/, "")
  }

  const protocol = getRequestProtocol(event, {
    xForwardedProto: true
  })
  const host = getRequestHost(event, {
    xForwardedHost: true
  })

  return `${protocol}://${host}`
}

export default defineEventHandler(async (event) => {
  if (event.method !== "POST") {
    setResponseStatus(event, 405)
    return {
      error: true,
      message: "Metodo no permitido"
    }
  }

  const body = await readBody<ForgotPasswordBody>(event)
  const email = normalizeEmail(body.email || "")

  if (!email || !/^\S+@\S+\.\S+$/.test(email)) {
    throw createError({
      statusCode: 400,
      statusMessage: "Correo invalido"
    })
  }

  const user = await prisma.user.findUnique({
    where: {
      email
    }
  })

  if (!user) {
    return {
      sent: true,
      message: "Si existe una cuenta con ese correo, enviamos instrucciones para restablecer la contrasena."
    }
  }

  await prisma.passwordResetToken.deleteMany({
    where: {
      userId: user.id,
      usedAt: null
    }
  })

  const token = await issuePasswordResetToken(user.id)
  const resetUrl = `${getResetBaseUrl(event)}/login?mode=reset&token=${encodeURIComponent(token)}`

  await sendAuthEmail({
    to: user.email,
    subject: "Restablece tu contrasena en vitrio.cl",
    text: `Recibimos una solicitud para restablecer tu contrasena. Abre este enlace: ${resetUrl}`,
    html: `<p>Recibimos una solicitud para restablecer tu contrasena.</p><p><a href=\"${resetUrl}\">Restablecer contrasena</a></p><p>Este enlace vence en 30 minutos.</p>`
  })

  return {
    sent: true,
    message: "Si existe una cuenta con ese correo, enviamos instrucciones para restablecer la contrasena."
  }
})