import { NextResponse } from "next/server";
import {
  adminCookieOptions,
  createAdminSession,
  findAdminByUsername,
  verifyPassword,
} from "@/lib/admin-auth";
import { logAdminActivity } from "@/lib/admin-activity";
import { logAdminLogin } from "@/lib/admin-login-log";
import { requestMeta } from "@/lib/request-meta";

export async function POST(req: Request) {
  const meta = requestMeta(req);
  try {
    const body = (await req.json()) as {
      username?: string;
      password?: string;
    };

    const password = body.password || "";
    // Legacy: password-only → treat as superadmin
    const username = (body.username || "superadmin").trim().toLowerCase();

    if (!password) {
      await logAdminLogin({
        outcome: "failure",
        ip: meta.ip,
        userAgent: meta.userAgent,
        meta: { username, reason: "missing_password" },
      });
      await logAdminActivity({
        username,
        action: "login_failure",
        resource: "login",
        outcome: "failure",
        ip: meta.ip,
        userAgent: meta.userAgent,
        meta: { reason: "missing_password" },
      });
      return NextResponse.json(
        { ok: false, error: "Username and password required" },
        { status: 401 },
      );
    }

    const admin = await findAdminByUsername(username);
    const valid =
      admin &&
      admin.is_active &&
      (await verifyPassword(password, admin.password_hash));

    if (!admin || !valid) {
      await logAdminLogin({
        outcome: "failure",
        ip: meta.ip,
        userAgent: meta.userAgent,
        meta: { username },
      });
      await logAdminActivity({
        adminId: admin?.id ?? null,
        username,
        action: "login_failure",
        resource: "login",
        outcome: "failure",
        ip: meta.ip,
        userAgent: meta.userAgent,
      });
      return NextResponse.json(
        { ok: false, error: "Invalid username or password" },
        { status: 401 },
      );
    }

    const session = await createAdminSession({
      adminId: admin.id,
      ip: meta.ip,
      userAgent: meta.userAgent,
    });

    await logAdminLogin({
      outcome: "success",
      ip: meta.ip,
      userAgent: meta.userAgent,
      meta: { username: admin.username, role: admin.role },
    });
    await logAdminActivity({
      adminId: admin.id,
      username: admin.username,
      action: "login_success",
      resource: "login",
      outcome: "success",
      ip: meta.ip,
      userAgent: meta.userAgent,
      meta: { role: admin.role, session_id: session.sessionId },
    });

    const res = NextResponse.json({
      ok: true,
      admin: {
        username: admin.username,
        role: admin.role,
        display_name: admin.display_name,
      },
    });
    res.cookies.set(adminCookieOptions(session.jwt));
    return res;
  } catch (e) {
    console.error("login failed", e);
    await logAdminLogin({
      outcome: "failure",
      ip: meta.ip,
      userAgent: meta.userAgent,
      meta: { error: "exception" },
    });
    await logAdminActivity({
      action: "login_failure",
      resource: "login",
      outcome: "error",
      ip: meta.ip,
      userAgent: meta.userAgent,
      meta: { error: "exception" },
    });
    return NextResponse.json(
      { ok: false, error: "Login failed" },
      { status: 500 },
    );
  }
}