import { NextRequest, NextResponse } from 'next/server'
import pool from '@/lib/db'
import { verifyPassword, createAdminSession, setAdminCookie, logAdminAudit } from '@/lib/admin-auth'
import { getClientIp } from '@/lib/auth'
import { checkRateLimit, RATE_LIMITS } from '@/lib/rate-limit'

export async function POST(request: NextRequest) {
  const ip = getClientIp(request) || 'unknown'

  // Reuse the auth-verify rate limit (10/IP/15min)
  const rl = checkRateLimit(`admin-login:${ip}`, RATE_LIMITS.authVerify)
  if (!rl.allowed) {
    return NextResponse.json({ error: 'Too many attempts. Try again later.' }, { status: 429 })
  }

  const body = await request.json().catch(() => ({}))
  const email = (body.email || '').trim().toLowerCase()
  const password = body.password || ''

  if (!email || !password) {
    return NextResponse.json({ error: 'Email and password required' }, { status: 400 })
  }

  const { rows } = await pool.query(
    `SELECT id, email, name, password_hash, is_active FROM pitch_admins WHERE email = $1`,
    [email],
  )

  if (rows.length === 0) {
    await logAdminAudit(null, 'admin_login_failed', { email, reason: 'unknown_email' }, request)
    return NextResponse.json({ error: 'Invalid credentials' }, { status: 401 })
  }

  const admin = rows[0]

  if (!admin.is_active) {
    await logAdminAudit(admin.id, 'admin_login_failed', { reason: 'inactive' }, request)
    return NextResponse.json({ error: 'Account disabled' }, { status: 403 })
  }

  const ok = await verifyPassword(password, admin.password_hash)
  if (!ok) {
    await logAdminAudit(admin.id, 'admin_login_failed', { reason: 'wrong_password' }, request)
    return NextResponse.json({ error: 'Invalid credentials' }, { status: 401 })
  }

  const ua = request.headers.get('user-agent')
  const { jwt } = await createAdminSession(admin.id, ip, ua)
  await setAdminCookie(jwt)

  await pool.query(
    `UPDATE pitch_admins SET last_login_at = NOW(), updated_at = NOW() WHERE id = $1`,
    [admin.id],
  )

  await logAdminAudit(admin.id, 'admin_login_success', { email }, request)

  return NextResponse.json({
    success: true,
    admin: { id: admin.id, email: admin.email, name: admin.name },
  })
}
