import {NextRequest,NextResponse} from 'next/server';
import {createToken,digest,prisma,THIRTY_DAYS} from '@/lib/access';
export const runtime='nodejs';
export async function POST(request:NextRequest){
 try{
  const body=await request.json();
  if(typeof body.code!=='string'||!/^[A-Za-z0-9_-]{24}$/.test(body.code))return NextResponse.json({error:'Code invalide'},{status:400});
  const now=new Date();const codeHash=digest(body.code);
  const access=await prisma.$transaction(async tx=>{
   const code=await tx.accessCode.findUnique({where:{codeHash},include:{user:true}});
   if(!code||code.revokedAt||code.expiresAt&&code.expiresAt<=now)return null;
   if(!code.activatedAt){
    const result=await tx.accessCode.updateMany({where:{id:code.id,activatedAt:null,revokedAt:null},data:{activatedAt:now,expiresAt:new Date(now.getTime()+THIRTY_DAYS)}});
    if(result.count===0){
     const refreshed=await tx.accessCode.findUnique({where:{id:code.id}});
     if(!refreshed?.expiresAt||refreshed.expiresAt<=now)return null;
     return {userId:code.userId,expiresAt:refreshed.expiresAt,name:code.user.name};
    }
   }
   return {userId:code.userId,expiresAt:code.expiresAt??new Date(now.getTime()+THIRTY_DAYS),name:code.user.name};
  });
  if(!access)return NextResponse.json({error:'Code expiré, révoqué ou indisponible'},{status:403});
  const token=createToken();
  await prisma.loginSession.create({data:{userId:access.userId,tokenHash:digest(token),expiresAt:access.expiresAt}});
  const response=NextResponse.json({name:access.name,expiresAt:access.expiresAt},{headers:{'Cache-Control':'no-store'}});
  response.cookies.set('tachy_session',token,{httpOnly:true,secure:process.env.NODE_ENV==='production',sameSite:'lax',path:'/',expires:access.expiresAt});
  return response;
 }catch{return NextResponse.json({error:'Activation indisponible'},{status:500});}
}