import { NextRequest, NextResponse } from 'next/server'
import { supabase } from '@/lib/supabase'
import crypto from 'crypto'

export async function POST(request: NextRequest) {
  try {
    const { email, code } = await request.json()

    if (!email || !code) {
      return NextResponse.json(
        { error: 'Email and verification code are required' },
        { status: 400 }
      )
    }

    const emailKey = email.trim().toLowerCase()

    // Fetch the latest unverified code for this email
    const { data: storedCode, error: fetchError } = await supabase
      .from('signup_verification_codes')
      .select('*')
      .eq('email', emailKey)
      .eq('verified', false)
      .order('expires_at', { ascending: false })
      .limit(1)
      .maybeSingle()

    if (fetchError) {
      console.error('Supabase fetch error:', fetchError)
      return NextResponse.json({ error: 'Failed to fetch verification code' }, { status: 500 })
    }

    if (!storedCode) {
      return NextResponse.json(
        { error: 'Verification code not found. Please request a new code.' },
        { status: 400 }
      )
    }

    const now = Date.now()
    if (storedCode.expires_at < now) {
      // Optionally, you could delete expired codes
      await supabase
        .from('signup_verification_codes')
        .delete()
        .eq('id', storedCode.id)
      return NextResponse.json(
        { error: 'Verification code has expired. Please request a new code.' },
        { status: 400 }
      )
    }

    if (storedCode.code !== code.trim()) {
      return NextResponse.json(
        { error: 'Invalid verification code. Please try again.' },
        { status: 400 }
      )
    }

    // Code is valid – mark as verified and generate token
    const verificationToken = crypto.randomBytes(32).toString('hex')
    const tokenExpiresAt = Date.now() + 15 * 60 * 1000 // 15 minutes

    const { error: updateError } = await supabase
      .from('signup_verification_codes')
      .update({
        verified: true,
        token: verificationToken,
        token_expires_at: tokenExpiresAt,
      })
      .eq('id', storedCode.id)

    if (updateError) {
      console.error('Supabase update error:', updateError)
      return NextResponse.json(
        { error: 'Failed to update verification status' },
        { status: 500 }
      )
    }

    console.log(`✅ Email verified for ${emailKey}, token expires at ${new Date(tokenExpiresAt).toISOString()}`)

    return NextResponse.json({
      success: true,
      message: 'Email verified successfully',
      token: verificationToken,
    })

  } catch (error: any) {
    console.error('Verify code error:', error)
    return NextResponse.json(
      { error: error.message || 'Internal server error' },
      { status: 500 }
    )
  }
}

// Helper function to check if email is verified
export async function checkEmailVerified(email: string, token: string): Promise<boolean> {
  const emailKey = email.trim().toLowerCase()

  const { data: codeEntry } = await supabase
    .from('signup_verification_codes')
    .select('*')
    .eq('email', emailKey)
    .eq('verified', true)
    .eq('token', token)
    .maybeSingle()

  if (!codeEntry) return false
  if (codeEntry.token_expires_at && codeEntry.token_expires_at < Date.now()) return false

  return true
}