export const dynamic = 'force-dynamic'

import { NextRequest, NextResponse } from 'next/server'
import { asAdmin } from '@/lib/db/with-user'
import { users, passwordResetTokens } from '@/lib/db/schema'
import { eq, and, gt, isNull } from 'drizzle-orm'
import { createHash } from 'crypto'
import { hashPassword } from '@/lib/auth/password'

export async function POST(req: NextRequest) {
  const { token, password } = await req.json()
  if (!token || !password || password.length < 8) {
    return NextResponse.json({ error: 'Invalid request' }, { status: 400 })
  }

  const tokenHash = createHash('sha256').update(token).digest('hex')
  const now = new Date()

  const [row] = await asAdmin(db =>
    db.select({ id: passwordResetTokens.id, userId: passwordResetTokens.userId })
      .from(passwordResetTokens)
      .where(and(
        eq(passwordResetTokens.tokenHash, tokenHash),
        gt(passwordResetTokens.expiresAt, now),
        isNull(passwordResetTokens.usedAt),
      )).limit(1)
  )

  if (!row) {
    return NextResponse.json({ error: 'Invalid or expired token' }, { status: 400 })
  }

  const newHash = await hashPassword(password)

  await asAdmin(async db => {
    await db.update(users).set({ passwordHash: newHash }).where(eq(users.id, row.userId))
    await db.update(passwordResetTokens).set({ usedAt: now }).where(eq(passwordResetTokens.id, row.id))
  })

  return NextResponse.json({ ok: true })
}