"use server";

import { headers } from "next/headers";
import { redirect } from "next/navigation";
import { z } from "zod";
import { login } from "@/server/auth/login";
import { RATE_LIMIT_WINDOW_MINUTES } from "@/server/auth/rate-limit";

const loginSchema = z.object({
  username: z.string().trim().min(1, "Username is required").max(100),
  password: z.string().min(1, "Password is required").max(200),
});

export type LoginFormState = {
  error?: string;
  fieldErrors?: { username?: string; password?: string };
  username?: string;
};

async function getClientIp(): Promise<string> {
  const h = await headers();
  return h.get("x-forwarded-for")?.split(",")[0]?.trim() || h.get("x-real-ip") || "unknown";
}

export async function loginAction(_prev: LoginFormState, formData: FormData): Promise<LoginFormState> {
  const parsed = loginSchema.safeParse({
    username: formData.get("username"),
    password: formData.get("password"),
  });

  const username = String(formData.get("username") ?? "");

  if (!parsed.success) {
    const flat = z.flattenError(parsed.error).fieldErrors;
    return {
      username,
      fieldErrors: { username: flat.username?.[0], password: flat.password?.[0] },
    };
  }

  const result = await login(parsed.data.username, parsed.data.password, await getClientIp());

  if (!result.ok) {
    return {
      username,
      error:
        result.reason === "rate_limited"
          ? `Too many failed attempts. Try again in ${RATE_LIMIT_WINDOW_MINUTES} minutes.`
          : "Invalid username or password.",
    };
  }

  redirect("/");
}