"use server";

import { redirect } from "next/navigation";
import { z } from "zod";
import { db } from "@/lib/db";
import { hashPassword, verifyPassword, createSession, destroySession } from "@/lib/auth";
import { audit } from "@/lib/audit";
import { sendWelcomeEmail } from "@/lib/email";

const loginSchema = z.object({ email: z.string().email(), password: z.string().min(1) });

export async function loginAction(formData: FormData) {
  const next = String(formData.get("next") || "");
  const parsed = loginSchema.safeParse({
    email: formData.get("email"),
    password: formData.get("password"),
  });
  if (!parsed.success) redirect(`/login?error=${encodeURIComponent("Enter a valid email and password.")}`);

  const user = await db.user.findUnique({ where: { email: parsed.data.email.toLowerCase() } });
  if (!user || !(await verifyPassword(parsed.data.password, user.passwordHash))) {
    redirect(`/login?error=${encodeURIComponent("Invalid email or password.")}`);
  }
  await createSession(user.id);
  await audit({ userId: user.id, action: "auth.login" });
  const home =
    user.platformRole === "SUPER_ADMIN" ? "/admin" : user.platformRole === "ORGANIZER" ? "/dashboard" : "/me";
  redirect(next && next.startsWith("/") ? next : home);
}

const signupSchema = z.object({
  name: z.string().min(2, "Name is too short"),
  email: z.string().email("Enter a valid email"),
  password: z.string().min(8, "Password must be at least 8 characters"),
  organization: z.string().optional(),
  accountType: z.enum(["ATTENDEE", "ORGANIZER"]).default("ATTENDEE"),
});

export async function signupAction(formData: FormData) {
  const parsed = signupSchema.safeParse({
    name: formData.get("name"),
    email: formData.get("email"),
    password: formData.get("password"),
    organization: formData.get("organization") || undefined,
    accountType: formData.get("accountType") || "ATTENDEE",
  });
  if (!parsed.success) {
    redirect(`/signup?error=${encodeURIComponent(parsed.error.issues[0].message)}`);
  }
  const email = parsed.data.email.toLowerCase();
  const existing = await db.user.findUnique({ where: { email } });
  if (existing) redirect(`/signup?error=${encodeURIComponent("An account with this email already exists.")}`);

  const organizer = parsed.data.accountType === "ORGANIZER";
  const user = await db.user.create({
    data: {
      email,
      name: parsed.data.name,
      organization: parsed.data.organization,
      passwordHash: await hashPassword(parsed.data.password),
      platformRole: organizer ? "ORGANIZER" : "USER",
      emailVerified: true, // email delivery is mocked in this build
    },
  });
  await createSession(user.id);
  await sendWelcomeEmail(email, parsed.data.name, organizer);
  await audit({ userId: user.id, action: "auth.signup", meta: { accountType: parsed.data.accountType } });
  redirect(organizer ? "/dashboard" : "/me");
}

export async function logoutAction() {
  await destroySession();
  redirect("/login");
}