import { db } from "../db.ts";
import { issueToken } from "../auth.ts";

export const handleLogin = async (req: Request): Promise<Response> => {
    if (req.method !== "POST") {
        return Response.json({ error: "Method not allowed" }, { status: 405 });
    }

    let body: unknown;
    try {
        body = await req.json();
    } catch {
        return Response.json({ error: "Invalid JSON" }, { status: 400 });
    }

    if (!body || typeof body !== "object") {
        return Response.json({ error: "Body must be a JSON object" }, { status: 400 });
    }

    const { username, password } = body as { username?: string; password?: string };
    if (!username || !password) {
        return Response.json({ error: "username and password required" }, { status: 400 });
    }

    const [user] = await db`
        SELECT id, password_hash FROM users WHERE username = ${username}
    `;

    if (!user || !await Bun.password.verify(password, user.password_hash as string)) {
        return Response.json({ error: "Invalid credentials" }, { status: 401 });
    }

    const token = await issueToken(user.id as number);
    return Response.json({ token });
};
