import { NextRequest, NextResponse } from 'next/server';
import { cookies } from 'next/headers';

const API_BASE_URL = process.env.API_BASE_URL || "https://admin.mymorni.com/api/v1";

export async function POST(req: NextRequest) {
  try {
    const body = await req.json();
    const { email, password } = body;

    // Validate input
    if (!email || !password) {
      return NextResponse.json(
        { success: false, message: 'Email and password are required' },
        { status: 400 }
      );
    }

    // Call backend API
    const response = await fetch(`${API_BASE_URL}/login`, {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify({ email, password }),
    });

    const data = await response.json();

    if (!response.ok || !data.success) {
      return NextResponse.json(
        { success: false, message: data.message || 'Login failed' },
        { status: response.status }
      );
    }

    // Set secure HTTP-only cookies
    const cookieStore = await cookies();
    
    // Server-side HTTP-only token (secure)
    cookieStore.set('token', data.access_token, {
      httpOnly: true,
      secure: process.env.NODE_ENV === 'production',
      sameSite: 'lax',
      maxAge: 60 * 60 * 24 * 7, // 7 days
      path: '/',
    });

    // Also set client-side token for backward compatibility
    cookieStore.set('token_client', data.access_token, {
      httpOnly: false, // Accessible by client
      secure: process.env.NODE_ENV === 'production',
      sameSite: 'lax',
      maxAge: 60 * 60 * 24 * 7, // 7 days
      path: '/',
    });

    cookieStore.set('getUser', JSON.stringify(data.data), {
      httpOnly: false, // Accessible by client for UI
      secure: process.env.NODE_ENV === 'production',
      sameSite: 'lax',
      maxAge: 60 * 60 * 24 * 7,
      path: '/',
    });

    // Return response with client-accessible token for legacy support
    return NextResponse.json({
      success: true,
      message: 'Login successful',
      access_token: data.access_token, // For client-side cookie setting
      has_user_allow_to_share_vision_board: data.data?.has_user_allow_to_share_vision_board,
      data: {
        id: data.data?.id,
        name: data.data?.name,
        email: data.data?.email,
        has_user_allow_to_share_vision_board: data.data?.has_user_allow_to_share_vision_board,
      },
    });
  } catch (error: any) {
    console.error(
      error instanceof Error ? error.message : 'Login request failed'
    );
    return NextResponse.json(
      { success: false, message: 'Internal server error' },
      { status: 500 }
    );
  }
}