import { NextRequest, NextResponse } from "next/server";
import { db, PasswordResetRequest } from "@/lib/admin/db";
import { getClientMetadata } from "@/lib/admin/auth";
import { sendMail } from "@/lib/mail";
import { renderEmail } from "@/emails/render";
import { AdminResetRequestAlertEmail } from "@/emails/templates/admin-reset-request-alert";

export async function POST(req: NextRequest) {
  try {
    const body = await req.json();
    const email = typeof body.email === "string" ? body.email.trim().toLowerCase() : "";
    const { ip } = getClientMetadata(req);

    if (!email) {
      return NextResponse.json(
        { error: "Please enter your administrator email address." },
        { status: 400 }
      );
    }

    const user = await db.getUserByEmail(email);

    if (user && user.status === "ACTIVE") {
      const rawToken = await db.createPasswordResetToken(user.id, user.email, 60);
      const origin = req.nextUrl.origin || "https://quto.ai";
      const resetUrl = `${origin}/admin/reset-password?token=${rawToken}`;

      await db.logSecurityEvent({
        actorId: user.id,
        actorName: user.name,
        actorEmail: user.email,
        actorLevel: user.level,
        targetUserId: user.id,
        targetUserEmail: user.email,
        targetUserName: user.name,
        action: "PASSWORD_RESET_REQUESTED",
        details: {
          note: "Password reset token generated and dispatched via email.",
        },
        ipAddress: ip,
      });

      try {
        await sendMail({
          to: user.email,
          subject: "Reset Your Administrator Password — Quto AI",
          html: `
            <div style="font-family: sans-serif; max-width: 560px; margin: 0 auto; padding: 24px; border: 1px solid #e5e5e5; border-radius: 12px; background: #ffffff;">
              <h2 style="color: #171717; margin-top: 0;">Password Reset Request</h2>
              <p style="color: #525252; font-size: 14px; line-height: 1.6;">Hello ${user.name},</p>
              <p style="color: #525252; font-size: 14px; line-height: 1.6;">A request was received to reset your administrator password for Quto AI. Click the secure button below to set a new password. This link is valid for <strong>60 minutes</strong> and can only be used once.</p>
              <div style="margin: 28px 0; text-align: center;">
                <a href="${resetUrl}" style="background: #171717; color: #ffffff; text-decoration: none; padding: 12px 24px; border-radius: 8px; font-weight: 600; font-size: 14px; display: inline-block;">Reset Password</a>
              </div>
              <p style="color: #a3a3a3; font-size: 12px; line-height: 1.5;">If you did not request a password reset, please disregard this email or report it to your security administrator immediately.</p>
            </div>
          `,
          text: `Hello ${user.name},\n\nA request was received to reset your password. Use the link below (valid for 60 minutes):\n${resetUrl}\n\nIf you did not request this, please ignore this email.`,
        });
      } catch (mailError) {
        console.error("[forgot-password] Error sending reset email:", mailError);
      }
    }

    // Generic response to prevent account enumeration
    return NextResponse.json({
      ok: true,
      message:
        "If your account exists in our administrator directory, a secure password reset link has been dispatched to your email address.",
    });
  } catch (error) {
    console.error("[api/admin/auth/forgot-password] Error:", error);
    return NextResponse.json(
      { error: "An error occurred while processing your request." },
      { status: 500 }
    );
  }
}