import { NextRequest, NextResponse } from "next/server";
import { db } from "@/lib/db";
import bcrypt from "bcryptjs";
import { makeUnlockCookieValue } from "@/lib/review-auth";

export async function POST(
  req: NextRequest,
  { params }: { params: Promise<{ token: string }> }
) {
  const { token } = await params;

  const body = await req.json().catch(() => ({}));
  const { password } = body as { password?: string };

  if (!password || typeof password !== "string") {
    return NextResponse.json({ error: "Password required" }, { status: 400 });
  }

  const session = await db.reviewSession.findUnique({ where: { token } });
  if (!session || !session.isActive) {
    return NextResponse.json({ error: "Invalid or expired review link" }, { status: 403 });
  }
  if (session.expiresAt && session.expiresAt < new Date()) {
    return NextResponse.json({ error: "Invalid or expired review link" }, { status: 403 });
  }

  if (!session.passwordHash) {
    return NextResponse.json({ success: true });
  }

  const valid = await bcrypt.compare(password, session.passwordHash);
  if (!valid) {
    return NextResponse.json({ error: "Incorrect password" }, { status: 401 });
  }

  const cookieName = `rsauth_${token}`;
  const cookieValue = makeUnlockCookieValue(token);

  const res = NextResponse.json({ success: true });
  res.cookies.set(cookieName, cookieValue, {
    httpOnly: true,
    sameSite: "lax",
    path: "/",
    expires: session.expiresAt,
    secure: process.env.NODE_ENV === "production",
  });
  return res;
}