"use server";
import { redirect } from "next/navigation";
import { db } from "@/lib/db";
import { clientIp, createSession, destroySession, verifyPassword } from "@/lib/auth";
import { loginBlocked, recordLogin } from "@/lib/rate-limit";
import { isStaff } from "@/lib/permissions";
import { audit } from "@/lib/audit";

export async function adminLogin(_: { message?: string } | null, fd: FormData): Promise<{ message?: string }> {
  const email = String(fd.get("email") ?? "").trim().toLowerCase();
  const password = String(fd.get("password") ?? "");
  const ip = await clientIp();
  if (await loginBlocked(email, ip)) return { message: "Too many failed attempts. Try again in 15 minutes." };
  const user = await db.user.findUnique({ where: { email } });
  // Always run a hash comparison to keep timing similar for unknown emails.
  const ok = await verifyPassword(password, user?.passwordHash ?? "$2a$12$invalidinvalidinvalidinvalidinvalidinvalidinvalidinvalidinv");
  const valid = !!user && ok && user.active && isStaff(user.role);
  await recordLogin(email, ip, valid);
  if (!valid) return { message: "Email or password is incorrect." };
  await createSession(user!);
  await db.user.update({ where: { id: user!.id }, data: { lastLoginAt: new Date() } });
  await audit(user!.id, "auth.login", "User", user!.id);
  redirect("/admin");
}

export async function adminLogout() { await destroySession(); redirect("/admin/login"); }