import { NextResponse } from "next/server";
import {
  hashAadhaar,
  isValidAadhaarFormat,
  normalizeAadhaar,
} from "@/lib/aadhaar";
import { aadhaarExists } from "@/lib/visitors";
import { auditLog } from "@/lib/audit";
import { evaluateHuman, humanRejectResponse } from "@/lib/human";
import { requestMeta } from "@/lib/request-meta";
import {
  recordHumanCheckReject,
  withRegistrationSecurity,
} from "@/lib/security";
import { safeError } from "@/lib/safe-log";

export async function POST(req: Request) {
  return withRegistrationSecurity(
    req,
    {
      routeGroup: "registration",
      pathNorm: "/api/v1/registration/aadhaar/validate",
    },
    async () => {
      const meta = requestMeta(req);
      try {
        const body = await req.json();
        const human = evaluateHuman(body.human);
        if (!human.ok) {
          await auditLog({
            step: "human_check",
            outcome: "reject",
            ip: meta.ip,
            userAgent: meta.userAgent,
            meta: {
              reason: human.reason,
              score: human.score,
              at: "aadhaar_validate",
            },
          });
          recordHumanCheckReject({
            at: "aadhaar_validate",
            reason: human.reason,
            score: human.score,
            sourceIp: meta.ip,
          });
          return NextResponse.json(humanRejectResponse(human.reason), {
            status: 403,
          });
        }

        const aadhaar = normalizeAadhaar(String(body.aadhaar_number || ""));

        if (!isValidAadhaarFormat(aadhaar)) {
          await auditLog({
            step: "aadhaar_validate",
            outcome: "invalid",
            ip: meta.ip,
            userAgent: meta.userAgent,
          });
          return NextResponse.json(
            {
              ok: false,
              error:
                "The Aadhaar number appears to be incorrect. Please re-enter.",
            },
            { status: 400 },
          );
        }

        const existing = await aadhaarExists(hashAadhaar(aadhaar));
        if (existing) {
          await auditLog({
            step: "aadhaar_validate",
            outcome: "duplicate",
            ip: meta.ip,
            userAgent: meta.userAgent,
            meta: { pass_no: existing },
          });
          return NextResponse.json(
            {
              ok: false,
              error: "This Aadhaar is already registered.",
              pass_no: existing,
            },
            { status: 409 },
          );
        }

        await auditLog({
          step: "aadhaar_validate",
          outcome: "ok",
          ip: meta.ip,
          userAgent: meta.userAgent,
          meta: { human_score: human.score },
        });
        return NextResponse.json({
          ok: true,
          masked: `XXXX XXXX ${aadhaar.slice(-4)}`,
        });
      } catch (e) {
        safeError(e);
        return NextResponse.json(
          { ok: false, error: "Unable to validate Aadhaar right now." },
          { status: 500 },
        );
      }
    },
  );
}