import { NextResponse } from "next/server";
import { currentUser } from "@/lib/auth";
import { checkRateLimit, readJson } from "@/lib/api-security";
import { EmailVerificationError, normalizeEmail, requestEmailChallenge } from "@/lib/email-pin";

export async function POST(request: Request) {
  try {
    // Works both for login (no session) and attaching an email to a cabinet.
    const user = await currentUser();
    // §10.2 analogy: at most 3 sends per hour per IP besides per-address limits.
    checkRateLimit(request, "email-pin", 3, 60 * 60 * 1000);
    const body = await readJson<{ email?: unknown }>(request, 4 * 1024);
    const email = normalizeEmail(typeof body.email === "string" ? body.email : "");
    if (!email) return NextResponse.json({ error: "bad_request", message: "Проверьте адрес почты." }, { status: 400 });
    await requestEmailChallenge({ email, userId: user?.id, ip: request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() || undefined });
    // Never disclose whether the address already exists in the system.
    return NextResponse.json({ ok: true, message: "Код отправлен на почту." }, { headers: { "Cache-Control": "no-store" } });
  } catch (error) {
    if (error instanceof EmailVerificationError) return NextResponse.json({ error: "rate_limited", message: error.message }, { status: error.status });
    return NextResponse.json({ error: "email_unavailable", message: "Не удалось отправить письмо. Попробуйте позже." }, { status: 502 });
  }
}