import { NextResponse } from "next/server";
import bcrypt from "bcryptjs";
import { prisma } from "@/lib/prisma";
import { verifyStepToken } from "@/lib/reset-otp";

/** Step 3 — set the new password (valid for 10 minutes after OTP verify). */
export async function POST(req: Request) {
  const body = (await req.json().catch(() => ({}))) as { resetToken?: string; password?: string };
  const uid = await verifyStepToken(body.resetToken ?? "", "reset");
  if (!uid) return NextResponse.json({ error: "SESSION_EXPIRED" }, { status: 401 });

  const password = body.password ?? "";
  if (password.length < 6) {
    return NextResponse.json({ error: "PASSWORD_TOO_SHORT" }, { status: 400 });
  }

  const user = await prisma.user.findUnique({ where: { id: uid }, select: { id: true, status: true } });
  if (!user || user.status !== "ACTIVE") {
    return NextResponse.json({ error: "SESSION_EXPIRED" }, { status: 401 });
  }

  await prisma.user.update({
    where: { id: uid },
    data: { passwordHash: await bcrypt.hash(password, 10) },
  });
  await prisma.passwordResetOtp.deleteMany({ where: { userId: uid } });

  return NextResponse.json({ ok: true });
}