import { ApiV1Error } from "@/lib/api-v1/errors";
import { buildSessionPayload, createExternalSupabaseClient } from "@/lib/api-v1/auth";
import { apiJsonOk, toApiErrorResponse } from "@/lib/api-v1/response";
import { applyApiRateLimit } from "@/lib/api-v1/rate-limit";
import { parseJsonObject, requireTrimmedString } from "@/lib/api-v1/validators";

export async function POST(request: Request) {
  try {
    const rateLimit = applyApiRateLimit(request, {
      namespace: "api-v1:auth:login",
      windowMs: 60_000,
      maxPerIp: 10,
    });
    const body = await parseJsonObject(request);
    const email = requireTrimmedString(body.email, "missing_email", "Informe o email.");
    const password = requireTrimmedString(body.password, "missing_password", "Informe a senha.");

    const supabase = createExternalSupabaseClient();
    const { data, error } = await supabase.auth.signInWithPassword({ email, password });

    if (error || !data.session?.access_token || !data.session.refresh_token) {
      throw new ApiV1Error(401, "invalid_credentials", error?.message || "Credenciais invalidas.");
    }

    return apiJsonOk(
      {
        session: await buildSessionPayload(data.session.access_token, data.session.refresh_token),
      },
      { headers: rateLimit.headers }
    );
  } catch (error) {
    return toApiErrorResponse(error);
  }
}