import {
  clearLoginFailures,
  clientIp,
  isAdminNetworkAllowed,
  json,
  loginLockedFor,
  readJsonBody,
  recordLoginFailure,
  sameOrigin,
  sessionCookie,
  verifyPassword,
} from "../../../_lib/auth";
import { readAuth } from "../../../_lib/store";

export const dynamic = "force-dynamic";

export async function POST(request: Request) {
  if (!isAdminNetworkAllowed(request.headers)) return json({ error: "Admin is only available on the home network." }, 403);
  if (!sameOrigin(request)) return json({ error: "Cross-origin request refused." }, 403);
  const ip = clientIp(request.headers);
  const locked = loginLockedFor(ip);
  if (locked) return json({ error: `Too many attempts. Try again in ${locked} seconds.` }, 429);

  const auth = await readAuth();
  if (!auth.passwordHash) return json({ error: "No password is set yet." }, 409);
  const body = await readJsonBody<{ password?: string }>(request);
  const password = typeof body?.password === "string" ? body.password : "";
  if (!password || !(await verifyPassword(password, auth.passwordHash))) {
    recordLoginFailure(ip);
    console.warn(`[admin] failed login from ${ip}`);
    return json({ error: "Wrong password." }, 401);
  }
  clearLoginFailures(ip);
  console.log(`[admin] login from ${ip}`);
  return json({ ok: true }, 200, { "Set-Cookie": sessionCookie(auth.sessionSecret) });
}