export const prerender = false;

import type { APIRoute } from 'astro';
import { env } from 'cloudflare:workers';
import { sql } from 'drizzle-orm';
import { hashToken } from '@platform-modules/util/tokens';
import { buildAuthEngine, type AuthEnv } from '../../../lib/auth-engine.js';
import { getDb, type DbEnv } from '../../../lib/db.js';
import { invalidateAllSessionsForUser, type SessionEnv } from '../../../lib/session.js';
import { type StorefrontLimiterEnv } from '../../../lib/rate-limit.js';

export const POST: APIRoute = async ({ request, redirect }) => {
  const cfEnv = env as (AuthEnv & SessionEnv & DbEnv & StorefrontLimiterEnv) | undefined;

  const formData = await request.formData();
  const token = String(formData.get('token') ?? '');
  const password = String(formData.get('password') ?? '');
  const passwordConfirm = String(formData.get('passwordConfirm') ?? '');

  if (password.length < 8 || password !== passwordConfirm) {
    return redirect(`/reset-password/${token}?error=weak_password`, 302);
  }

  if (!cfEnv?.DB && !cfEnv?.DATABASE_URL) {
    return redirect(`/reset-password/${token}?error=invalid_token`, 302);
  }

  const { db } = getDb(cfEnv);
  const tokenHash = await hashToken(token);

  // Atomic claim: mark used_at in the same statement that checks it.
  // Two concurrent reset requests race here; only the first UPDATE returns a row.
  const claimRes = await db.execute(sql`
    UPDATE mod_storefront_password_resets
    SET used_at = NOW()
    WHERE token_hash = ${tokenHash}
      AND expires_at > NOW()
      AND used_at IS NULL
    RETURNING user_id
  `);
  const claimRows = (Array.isArray(claimRes) ? claimRes : (claimRes as { rows?: unknown[] }).rows) ?? [];
  const claimRow = claimRows[0] as { user_id?: unknown } | undefined;
  const userId = typeof claimRow?.user_id === 'string' ? claimRow.user_id : null;

  if (!userId) {
    return redirect(`/reset-password/${token}?error=invalid_token`, 302);
  }

  await buildAuthEngine(cfEnv).setPassword(userId, password);
  await db.execute(sql`UPDATE auth_users SET password_changed_at = NOW() WHERE id = ${userId}`);

  if (cfEnv.SESSION) {
    await invalidateAllSessionsForUser(cfEnv, userId);
  }

  return redirect('/login?reset=success', 302);
};