import { eq } from 'drizzle-orm'
import { Hono } from 'hono'
import { changePasswordSchema, loginSchema } from '../../shared/schemas.ts'
import { endSession, requireAuth, startSession } from '../auth/middleware.ts'
import { hashPassword, verifyAgainstDummy, verifyPassword } from '../auth/password.ts'
import { RateLimiter } from '../auth/rate-limit.ts'
import { deleteUserSessions } from '../auth/sessions.ts'
import { organizations, users } from '../db/schema.ts'
import { currentUser, fail, validate, type AppEnv } from '../lib/http.ts'
import { publicUser } from './users.ts'

export function authRoutes() {
  // 10 failed-or-successful attempts per email per 15 minutes
  const loginLimiter = new RateLimiter(10, 15 * 60 * 1000)

  return new Hono<AppEnv>()
    .post('/login', validate('json', loginSchema), async (c) => {
      const { email, password } = c.req.valid('json')
      if (!loginLimiter.attempt(email)) throw fail(429, 'Too many sign-in attempts. Try again in 15 minutes.')

      const db = c.get('db')
      const [user] = await db.select().from(users).where(eq(users.email, email))
      const valid = user?.active && user.passwordHash ? await verifyPassword(password, user.passwordHash) : await verifyAgainstDummy(password)
      if (!user || !valid) throw fail(401, 'Incorrect email or password')

      loginLimiter.reset(email)
      await db.update(users).set({ lastLoginAt: new Date() }).where(eq(users.id, user.id))
      await startSession(c, user.id)
      const [result] = await db.select(publicUser).from(users).where(eq(users.id, user.id))
      return c.json({ user: result })
    })

    .post('/logout', async (c) => {
      await endSession(c)
      return c.body(null, 204)
    })

    .get('/me', requireAuth, async (c) => {
      const me = currentUser(c)
      const db = c.get('db')
      const [user] = await db.select(publicUser).from(users).where(eq(users.id, me.id))
      const [organization] = await db.select({ id: organizations.id, name: organizations.name }).from(organizations).where(eq(organizations.id, me.organizationId))
      return c.json({ user, organization })
    })

    .post('/password', requireAuth, validate('json', changePasswordSchema), async (c) => {
      const me = currentUser(c)
      const { currentPassword, newPassword } = c.req.valid('json')
      const db = c.get('db')
      const [user] = await db.select({ passwordHash: users.passwordHash }).from(users).where(eq(users.id, me.id))
      if (!user.passwordHash || !(await verifyPassword(currentPassword, user.passwordHash))) throw fail(400, 'Current password is incorrect')

      await db.update(users).set({ passwordHash: await hashPassword(newPassword) }).where(eq(users.id, me.id))
      // Sign out everywhere else
      await deleteUserSessions(db, me.id)
      await startSession(c, me.id)
      return c.body(null, 204)
    })
}