import { and, eq, gt, sql } from 'drizzle-orm';
import * as z from 'zod';
import { accounts, providers, recoveryLinks, sessions, twoFactors, users } from '~~/drizzle/schema';
import { lockAccount, revokeTwoFactorTrust } from "~~/server/lib/account-security";
import { authTransaction } from "~~/server/lib/auth-transaction";
import { auth } from '~~/lib/auth';

/**
 * Sets a password with a one-time link.
 *
 * For an account an admin just created this is its first password, and there
 * is nothing else to do. For a forgotten password it is a recovery:
 *
 * The saved API keys are encrypted with a key derived from the old password.
 * Nobody has that password anymore, so the keys can never be read again and
 * are deleted here. Chats, agents, files and everything else stay.
 */
export default defineEventHandler(async (event) => {
    const result = await readValidatedBody(event, (body) =>
        z
            .object({
                password: z.string().min(8).max(128),
            })
            .safeParse(body),
    );

    if (!result.success) {
        throw createError({
            statusCode: 400,
            message: result.error.issues[0]!.message,
            data: {
                code: 'INVALID_BODY',
            },
        });
    }

    const token = getRouterParam(event, 'token')!;
    const tokenHash = hashRecoveryToken(token);
    const { password } = result.data;

    const invalidLink = () => createError({
        statusCode: 410,
        statusMessage: 'This recovery link is not valid anymore',
        data: {
            code: 'RECOVERY_LINK_INVALID',
        },
    });

    // Hashing a password is slow on purpose and anyone can call this, so a
    // link that does not work is turned away before any of that is done.
    const candidate = await findRecoveryLink(token);
    if (!candidate) {
        throw invalidLink();
    }

    const { password: hasher, internalAdapter } = await auth.$context;
    const passwordHash = await hasher.hash(password);

    const recovered = await authTransaction(async (tx) => {
        await lockAccount(tx, candidate.userId);
        // deleting the link is what makes it work once: of two requests with
        // the same link only one gets a row back
        const [link] = await tx.delete(recoveryLinks)
            .where(and(eq(recoveryLinks.tokenHash, tokenHash), gt(recoveryLinks.expiresAt, new Date())))
            .returning({ userId: recoveryLinks.userId, resetSecurity: recoveryLinks.resetSecurity });

        if (!link) {
            return null;
        }

        // if either of these fails the link comes back with the rest of the
        // transaction
        const [credential] = await tx.select({ id: accounts.id }).from(accounts)
            .where(and(eq(accounts.userId, link.userId), eq(accounts.providerId, 'credential')));
        if (!credential) {
            await internalAdapter.linkAccount({
                providerId: 'credential',
                accountId: link.userId,
                password: passwordHash,
                userId: link.userId,
            });

            return 'created';
        }

        await internalAdapter.updatePassword(link.userId, passwordHash);

        await tx.update(providers).set({
            updatedAt: sql`greatest(date_trunc('milliseconds', clock_timestamp()), date_trunc('milliseconds', ${providers.updatedAt}) + interval '1 millisecond')`,
        }).where(eq(providers.userId, link.userId));

        // A provider without its key can't be used, so it is switched off
        // until the key is entered again. The provider and its models stay.
        await tx.update(providers)
            .set({
                config: sql`${providers.config} - 'apiKey'`,
                enabled: false,
                updatedAt: sql`${providers.updatedAt}`,
            })
            .where(and(eq(providers.userId, link.userId), sql`coalesce(${providers.config}->>'apiKey', '') <> ''`));

        // Every device is signed out, always: the ones still signed in hold
        // an encryption key derived from the old password.
        await tx.delete(sessions).where(eq(sessions.userId, link.userId));

        await revokeTwoFactorTrust(tx, link.userId);

        if (link.resetSecurity) {
            await tx.delete(twoFactors).where(eq(twoFactors.userId, link.userId));
            await tx.update(users).set({ twoFactorEnabled: false }).where(eq(users.id, link.userId));
        }

        return 'recovered';
    });

    // used or expired between the check above and here
    if (recovered === null) {
        throw invalidLink();
    }

    return { newAccount: recovered === 'created' };
});