// src/app/api/auth/magic/send/route.ts
import { sendMagicLink, validateOrigin } from "@moikapy/magic-link/next";

export async function POST(request: Request) {
  // CSRF protection (SEC-007)
  if (!validateOrigin(request)) {
    return Response.json({ error: "Invalid origin" }, { status: 403 });
  }

  const { email } = await request.json();
  const result = await sendMagicLink(email);
  // Always returns { ok: true } — prevents email enumeration
  return Response.json(result);
}

// src/app/api/auth/magic/verify/route.ts
import { verifyMagicToken, setSessionCookie, VERIFY_SECURITY_HEADERS } from "@moikapy/magic-link/next";

export async function GET(request: Request) {
  const token = new URL(request.url).searchParams.get("token");
  if (!token) {
    return Response.json(
      { ok: false, error: "invalid_token" },
      { status: 400, headers: VERIFY_SECURITY_HEADERS }
    );
  }

  const result = await verifyMagicToken(token);
  if (!result.ok) {
    return Response.json(result, { status: 400, headers: VERIFY_SECURITY_HEADERS });
  }

  // Set secure session cookie
  setSessionCookie(result.sessionId);

  // IMPORTANT: Use a hardcoded redirect URL, never user-controlled input (SEC-004)
  return Response.redirect("https://scholar.moikapy.dev/bible");
}

// src/app/api/auth/session/route.ts
import { getSession } from "@moikapy/magic-link/next";

export async function GET() {
  const { user } = await getSession();
  return Response.json({ user });
}

// src/app/api/auth/logout/route.ts
import { deleteSession } from "@moikapy/magic-link/next";

export async function POST() {
  await deleteSession();
  return Response.json({ ok: true });
}

// After OpenRouter OAuth callback — store key in D1, not cookie
import { storeApiKey, getApiKey } from "@moikapy/magic-link/next";

// Store (replaces httpOnly cookie approach)
await storeApiKey(openRouterApiKey);

// Retrieve (reads from D1, encrypted with AES-256-GCM)
const apiKey = await getApiKey();

const result = await sendMagicLink(email, {
  ...config,
  validateSend: async (email) => {
    // Check D1 for recent sends to this email
    const recent = await db.prepare(
      "SELECT COUNT(*) as count FROM magic_tokens WHERE email = ? AND created_at > ?"
    ).bind(email, Math.floor(Date.now() / 1000) - 900).first();
    if (recent?.count >= 3) throw new Error("Too many requests");
  },
});

// ❌ UNSAFE — attacker could control Host header
return Response.redirect(new URL("/", request.url));

// ✅ SAFE — hardcoded base URL
return Response.redirect("https://scholar.moikapy.dev/bible");

// On magic link login, migrate device data to real user
import { migrateDeviceUser } from "@moikapy/magic-link/db";

// In your verify route, after creating the session:
const deviceId = request.cookies.get("scholar_uid")?.value;
if (deviceId && deviceId !== "anonymous") {
  await migrateDeviceUser(db, deviceId, result.user.id);
  // Optionally delete the old device ID cookie
}

interface StorageAdapter {
  // Users
  findUserByEmail(email: string): Promise<User | null>;
  findUserById(id: string): Promise<User | null>;
  createUser(user: { id: string; email: string; displayName?: string }): Promise<User>;
  storeEncryptedApiKey(userId: string, encrypted: string): Promise<void>;
  getEncryptedApiKey(userId: string): Promise<string | null>;

  // Magic tokens
  storeToken(email: string, tokenHash: string, expiresAt: number): Promise<void>;
  findValidToken(tokenHash: string, now: number): Promise<MagicTokenRow | null>;
  markTokenUsed(tokenHash: string): Promise<void>;

  // Sessions
  createSession(sessionId: string, userId: string, expiresAt: number): Promise<void>;
  findSession(sessionId: string, now: number): Promise<SessionRow | null>;
  deleteSession(sessionId: string): Promise<void>;
}

interface EmailAdapter {
  send(params: { to: string; subject: string; html: string; text: string; from: string; fromName: string }): Promise<{ id: string }>;
}