import { and, eq, gt, sql } from 'drizzle-orm';
import * as z from 'zod';
import { providers, recoveryLinks, sessions, twoFactors, users } from '~~/drizzle/schema';
import { auth } from '~~/lib/auth';
import { db } from '~~/server/lib/db';

/**
 * Sets a password with a one-time link.
 *
 * For an account an admin just created this is its first password, and there
 * is nothing else to do. For a forgotten password it is a recovery:
 *
 * The saved API keys are encrypted with a key derived from the old password.
 * Nobody has that password anymore, so the keys can never be read again and
 * are deleted here. Chats, agents, files and everything else stay.
 */
export default defineEventHandler(async (event) => {
    const result = await readValidatedBody(event, (body) =>
        z
            .object({
                password: z.string().min(8).max(128),
            })
            .safeParse(body),
    );

    if (!result.success) {
        throw createError({
            statusCode: 400,
            message: result.error.issues[0]!.message,
            data: {
                code: 'INVALID_BODY',
            },
        });
    }

    const tokenHash = hashRecoveryToken(getRouterParam(event, 'token')!);
    const { password } = result.data;

    const { password: hasher, internalAdapter } = await auth.$context;
    const passwordHash = await hasher.hash(password);

    const recovered = await db.transaction(async (tx) => {
        // deleting the link is what makes it work once: of two requests with
        // the same link only one gets a row back
        const [link] = await tx.delete(recoveryLinks)
            .where(and(eq(recoveryLinks.tokenHash, tokenHash), gt(recoveryLinks.expiresAt, new Date())))
            .returning({ userId: recoveryLinks.userId, resetSecurity: recoveryLinks.resetSecurity });

        if (!link) return null;

        // if either of these fails the link comes back with the rest of the
        // transaction
        if (!await hasPassword(link.userId)) {
            await internalAdapter.linkAccount({
                providerId: 'credential',
                accountId: link.userId,
                password: passwordHash,
                userId: link.userId,
            });

            return 'created';
        }

        await internalAdapter.updatePassword(link.userId, passwordHash);

        // A provider without its key can't be used, so it is switched off
        // until the key is entered again. The provider and its models stay.
        await tx.update(providers)
            .set({
                config: sql`${providers.config} - 'apiKey'`,
                enabled: false,
            })
            .where(and(eq(providers.userId, link.userId), sql`coalesce(${providers.config}->>'apiKey', '') <> ''`));

        if (link.resetSecurity) {
            await tx.delete(twoFactors).where(eq(twoFactors.userId, link.userId));
            await tx.update(users).set({ twoFactorEnabled: false }).where(eq(users.id, link.userId));
            await tx.delete(sessions).where(eq(sessions.userId, link.userId));
        }

        return 'recovered';
    });

    if (recovered === null) {
        throw createError({
            statusCode: 410,
            statusMessage: 'This recovery link is not valid anymore',
            data: {
                code: 'RECOVERY_LINK_INVALID',
            },
        });
    }

    return { newAccount: recovered === 'created' };
});