import { jsonError, jsonOk, readJsonBody } from "@/lib/server/api";
import { requireAppSession } from "@/lib/server/auth/current-user";
import { changeOwnPassword } from "@/lib/server/account-store";
import { createPlatformSession, setPlatformSessionCookie } from "@/lib/server/auth/local";

export const runtime = "nodejs";

export async function POST(request: Request) {
  try {
    const session = await requireAppSession();
    const body = await readJsonBody<Record<string, unknown>>(request);
    const currentPassword = requiredString(body.currentPassword, "当前密码");
    const newPassword = requiredString(body.newPassword, "新密码");
    const confirmPassword = requiredString(body.confirmPassword, "确认密码");
    if (newPassword !== confirmPassword) throw Object.assign(new Error("两次输入的新密码不一致。"), { status: 400 });
    const user = await changeOwnPassword(session.user.id, currentPassword, newPassword);
    const nextSession = await createPlatformSession(user);
    const response = jsonOk({ ok: true, user: nextSession.user });
    await setPlatformSessionCookie(response, request.url, nextSession);
    return response;
  } catch (error) {
    return jsonError(error, 400, { request, source: "api.auth.password.change" });
  }
}

function requiredString(value: unknown, label: string): string {
  if (typeof value === "string" && value.trim()) return value.trim();
  throw Object.assign(new Error(`${label}不能为空。`), { status: 400 });
}