import bcrypt from 'bcryptjs';
import prisma from '../lib/prisma';
import { signAccess, signRefresh, verifyRefresh, TokenPayload } from '../lib/jwt';
import { AppError } from '../middleware/errorHandler';

export async function loginUser(email: string, password: string) {
  const user = await prisma.user.findUnique({ where: { email } });
  if (!user || !user.active) throw new AppError('Invalid credentials', 401);

  const valid = await bcrypt.compare(password, user.passwordHash);
  if (!valid) throw new AppError('Invalid credentials', 401);

  const payload: TokenPayload = { sub: user.id, role: user.role, name: user.name };
  const accessToken = signAccess(payload);
  const refreshToken = signRefresh(payload);

  return {
    accessToken,
    refreshToken,
    user: { id: user.id, name: user.name, email: user.email, role: user.role, phone: user.phone, avatarUrl: user.avatarUrl },
  };
}

export async function refreshTokens(refreshToken: string) {
  let payload: TokenPayload;
  try {
    payload = verifyRefresh(refreshToken);
  } catch {
    throw new AppError('Invalid refresh token', 401);
  }

  const user = await prisma.user.findUnique({ where: { id: payload.sub } });
  if (!user || !user.active) throw new AppError('User not found', 401);

  const newPayload: TokenPayload = { sub: user.id, role: user.role, name: user.name };
  return {
    accessToken: signAccess(newPayload),
    refreshToken: signRefresh(newPayload),
  };
}

export async function hashPassword(password: string): Promise<string> {
  return bcrypt.hash(password, 12);
}