import { Router, Request, Response } from 'express';
import { loginUser, refreshTokens } from '../services/auth.service';
import { authenticate, AuthRequest } from '../middleware/auth';
import { validate } from '../middleware/validate';
import { authLimiter } from '../middleware/rateLimits';
import { LoginSchema } from '@nobel/shared';
import prisma from '../lib/prisma';

const router = Router();

const COOKIE_OPTS = {
  httpOnly: true,
  secure: process.env.NODE_ENV === 'production',
  sameSite: 'lax' as const,
  maxAge: 7 * 24 * 60 * 60 * 1000,
  path: '/',
};

router.post('/login', authLimiter, validate(LoginSchema), async (req: Request, res: Response) => {
  const { email, password } = req.body as { email: string; password: string };
  const result = await loginUser(email, password);

  res.cookie('access_token', result.accessToken, { ...COOKIE_OPTS, maxAge: 15 * 60 * 1000 });
  res.cookie('refresh_token', result.refreshToken, COOKIE_OPTS);

  res.json({ user: result.user });
});

router.post('/logout', (_req, res) => {
  res.clearCookie('access_token', { path: '/' });
  res.clearCookie('refresh_token', { path: '/' });
  res.json({ ok: true });
});

router.get('/me', authenticate, async (req: AuthRequest, res: Response) => {
  const user = await prisma.user.findUnique({
    where: { id: req.user!.sub },
    select: { id: true, name: true, email: true, role: true, phone: true, avatarUrl: true, active: true, createdAt: true },
  });
  if (!user) { res.status(404).json({ error: 'User not found' }); return; }
  res.json(user);
});

router.post('/refresh', authLimiter, async (req, res) => {
  const token = req.cookies?.refresh_token;
  if (!token) { res.status(401).json({ error: 'No refresh token' }); return; }

  const tokens = await refreshTokens(token);
  res.cookie('access_token', tokens.accessToken, { ...COOKIE_OPTS, maxAge: 15 * 60 * 1000 });
  res.cookie('refresh_token', tokens.refreshToken, COOKIE_OPTS);
  res.json({ ok: true });
});

export default router;