export const prerender = false;

import type { APIRoute } from 'astro';
import { env } from 'cloudflare:workers';
import { AuthError } from '@platform-modules/auth';
import { buildAuthEngine, type AuthEnv } from '../../../lib/auth-engine.js';
import { setSession, type SessionEnv } from '../../../lib/session.js';
import { resolveSessionRole } from '../../../lib/session-role.js';
import { type DbEnv } from '../../../lib/db.js';
import { type StorefrontLimiterEnv } from '../../../lib/rate-limit.js';
import { jsonError } from '../../../lib/http.js';

const isLocalPath = (s: string): boolean => {
  if (typeof s !== 'string' || s.length === 0) return false;
  if (!s.startsWith('/')) return false;
  if (s.startsWith('//') || s.startsWith('/\\')) return false;
  try {
    const u = new URL(s, 'https://placeholder.invalid');
    return u.origin === 'https://placeholder.invalid';
  } catch {
    return false;
  }
};

export const POST: APIRoute = async ({ request, cookies, redirect }) => {
  const cfEnv = env as (AuthEnv & SessionEnv & DbEnv & StorefrontLimiterEnv) | undefined;
  if (!cfEnv?.SESSION || (!cfEnv?.DB && !cfEnv?.DATABASE_URL)) {
    return jsonError(503, 'service_unavailable', 'Service not configured.');
  }

  const formData = await request.formData();
  const email = String(formData.get('email') ?? '');
  const password = String(formData.get('password') ?? '');
  const redirectParam = String(formData.get('redirect') ?? '');

  try {
    const result = await buildAuthEngine(cfEnv).signIn({ email, password });
    const role = await resolveSessionRole(cfEnv, result.principal.userId);
    await setSession(cfEnv, cookies, { userId: result.principal.userId, role, email });
    const dest = isLocalPath(redirectParam) ? redirectParam : '/';
    return redirect(dest, 302);
  } catch (e) {
    if (e instanceof AuthError) {
      return redirect('/login?error=invalid_credentials', 302);
    }
    throw e;
  }
};