import { createError, readBody, setResponseStatus } from "h3"
import { consumePasswordResetToken, getSessionPayload, setAuthSession } from "~/server/utils/auth"
import { hashPassword } from "~/server/utils/password"
import { prisma } from "~/server/utils/prisma"

interface ResetPasswordBody {
  token?: string
  password?: string
}

export default defineEventHandler(async (event) => {
  if (event.method !== "POST") {
    setResponseStatus(event, 405)
    return {
      error: true,
      message: "Metodo no permitido"
    }
  }

  const body = await readBody<ResetPasswordBody>(event)
  const token = body.token?.trim() || ""
  const password = body.password || ""

  if (!token || !password) {
    throw createError({
      statusCode: 400,
      statusMessage: "Token y contrasena son obligatorios"
    })
  }

  const consumed = await consumePasswordResetToken(token)

  if (!consumed) {
    throw createError({
      statusCode: 400,
      statusMessage: "El enlace no es valido o vencio"
    })
  }

  let passwordHash: string

  try {
    passwordHash = hashPassword(password)
  } catch (error) {
    throw createError({
      statusCode: 400,
      statusMessage: error instanceof Error ? error.message : "Contrasena invalida"
    })
  }

  await prisma.$transaction([
    prisma.user.update({
      where: {
        id: consumed.userId
      },
      data: {
        passwordHash,
        emailVerifiedAt: new Date()
      }
    }),
    prisma.userSession.deleteMany({
      where: {
        userId: consumed.userId
      }
    }),
    prisma.passwordResetToken.deleteMany({
      where: {
        userId: consumed.userId,
        usedAt: null
      }
    })
  ])

  await setAuthSession(event, consumed.userId)

  return await getSessionPayload(event)
})