export const prerender = false;

import type { APIRoute } from 'astro';
import { env } from 'cloudflare:workers';
import { sql } from 'drizzle-orm';
import { generateOpaqueToken, hashToken } from '@platform-modules/util/tokens';
import { createMail } from '@platform-modules/mail';
import { type AuthEnv } from '../../../lib/auth-engine.js';
import { getDb, type DbEnv } from '../../../lib/db.js';
import { buildMailAdapter, type MailEnv } from '../../../lib/mail.js';
import { type SessionEnv } from '../../../lib/session.js';
import { type StorefrontLimiterEnv } from '../../../lib/rate-limit.js';

type ForgotEnv = AuthEnv & SessionEnv & DbEnv & StorefrontLimiterEnv & MailEnv & { SITE_ORIGIN?: string };

export const POST: APIRoute = async ({ request, redirect }) => {
  const cfEnv = env as ForgotEnv | undefined;
  if (!cfEnv?.DB && !cfEnv?.DATABASE_URL) {
    return redirect('/forgot-password?sent=1', 302);
  }

  const formData = await request.formData();
  const email = String(formData.get('email') ?? '');

  if (email) {
    try {
      const { db } = getDb(cfEnv);
      const res = await db.execute(sql`
        SELECT id FROM auth_users WHERE LOWER(email) = LOWER(${email}) LIMIT 1
      `);
      const rows = (Array.isArray(res) ? res : (res as { rows?: unknown[] }).rows) ?? [];
      const row = rows[0] as { id?: unknown } | undefined;
      const userId = typeof row?.id === 'string' ? row.id : null;

      if (userId) {
        const token = generateOpaqueToken(32);
        const tokenHash = await hashToken(token);

        await db.execute(sql`
          INSERT INTO mod_storefront_password_resets(token_hash, user_id, expires_at)
          VALUES(${tokenHash}, ${userId}, NOW() + INTERVAL '1 hour')
          ON CONFLICT(token_hash) DO NOTHING
        `);

        try {
          const siteOrigin = cfEnv?.SITE_ORIGIN?.replace(/\/+$/, '');
          const adapter = buildMailAdapter(cfEnv);
          if (adapter && siteOrigin) {
            await createMail(adapter).send({
              from: cfEnv.MAIL_FROM ?? 'noreply@mod-storefront.example',
              to: email,
              subject: 'Reset your password',
              text: `Click the link to reset your password: ${siteOrigin}/reset-password/${token}`,
            });
          } else if (!siteOrigin) {
            console.error('[mod-storefront/forgot] SITE_ORIGIN not configured — password reset email not sent');
          }
        } catch (mailErr) {
          console.error('[mod-storefront/forgot] mail send failed:', mailErr instanceof Error ? mailErr.message : mailErr);
        }
      }
    } catch (dbErr) {
      console.error('[mod-storefront/forgot] db error (user existence not revealed to client):', dbErr instanceof Error ? dbErr.message : dbErr);
    }
  }

  return redirect('/forgot-password?sent=1', 302);
};