import { NextRequest, NextResponse } from 'next/server'
import { createClient } from '@supabase/supabase-js'

const supabase = createClient(
  process.env.NEXT_PUBLIC_SUPABASE_URL!,
  process.env.SUPABASE_SERVICE_ROLE_KEY! // MUST be service role for server
)

export async function POST(request: NextRequest) {
  try {
    const { email, code } = await request.json()

    if (!email || !code) {
      return NextResponse.json(
        { error: 'Email and verification code are required' },
        { status: 400 }
      )
    }

    const emailKey = email.trim().toLowerCase()

    // 🔎 Fetch verification record from DB
    const { data: storedData, error } = await supabase
      .from('login_verification_codes')
      .select('*')
      .eq('email', emailKey)
      .single()

    if (error || !storedData) {
      return NextResponse.json(
        { error: 'Verification code not found. Please request a new code.' },
        { status: 400 }
      )
    }

    const now = Date.now()

    // ⏳ Check expiration
    if (storedData.expires_at < now) {
      await supabase
        .from('login_verification_codes')
        .delete()
        .eq('email', emailKey)

      return NextResponse.json(
        { error: 'Verification code has expired. Please request a new code.' },
        { status: 400 }
      )
    }

    // ❌ Invalid code
    if (storedData.code !== code.trim()) {
      return NextResponse.json(
        { error: 'Invalid verification code. Please try again.' },
        { status: 400 }
      )
    }

    // ✅ Mark as verified
    await supabase
      .from('login_verification_codes')
      .update({ verified: true })
      .eq('email', emailKey)

    return NextResponse.json({
      success: true,
      message: 'Email verified successfully'
    })

  } catch (error: any) {
    console.error('Verify login code error:', error)
    return NextResponse.json(
      { error: error.message || 'Internal server error' },
      { status: 500 }
    )
  }
}

// Check if login is verified
export async function checkLoginVerified(email: string): Promise<boolean> {
  const emailKey = email.trim().toLowerCase()

  const { data } = await supabase
    .from('login_verification_codes')
    .select('*')
    .eq('email', emailKey)
    .single()

  if (!data) return false

  if (data.expires_at < Date.now()) {
    await supabase
      .from('login_verification_codes')
      .delete()
      .eq('email', emailKey)
    return false
  }

  return data.verified === true
}