'use server';

import { headers } from 'next/headers';
import { redirect } from 'next/navigation';
import { prisma } from '@/lib/prisma';
import { createAdminSession, clearAdminSession } from '@/lib/adminAuth';
import { checkRateLimit, getClientIp } from '@/lib/rateLimit';

function safeNext(next: FormDataEntryValue | null) {
  const path = String(next ?? '');
  return path.startsWith('/') && !path.startsWith('//') ? path : '/admin/orders';
}

export async function loginAdmin(formData: FormData) {
  const username = String(formData.get('username') ?? '');
  const password = String(formData.get('password') ?? '');
  const next = safeNext(formData.get('next'));

  const ip = getClientIp(headers());
  const userAgent = headers().get('user-agent') ?? undefined;

  const { allowed } = await checkRateLimit(`login:admin:${ip}`, 5, 15 * 60 * 1000);
  if (!allowed) {
    // Log failed attempt (rate limited)
    await prisma.adminLoginLog.create({
      data: { success: false, ipAddress: ip, userAgent },
    });
    redirect(`/admin/login?error=rate_limited&next=${encodeURIComponent(next)}`);
  }

  if (username !== process.env.ADMIN_USER || password !== process.env.ADMIN_PASSWORD) {
    // Log failed attempt (wrong credentials)
    await prisma.adminLoginLog.create({
      data: { success: false, ipAddress: ip, userAgent },
    });
    redirect(`/admin/login?error=invalid&next=${encodeURIComponent(next)}`);
  }

  // Log successful login
  await prisma.adminLoginLog.create({
    data: { success: true, ipAddress: ip, userAgent },
  });

  await createAdminSession();
  redirect(next);
}

export async function logoutAdmin() {
  clearAdminSession();
  redirect('/admin/login');
}
