import { NextRequest, NextResponse } from 'next/server';
import { dbConnect } from '@/lib/dbConnect';
import { Admin } from '@/models/Admin';
import { signToken } from '@/lib/auth';
import { rateLimiter } from '@/lib/rateLimiter';
import { validateFields } from '@/lib/validation';

export async function POST(req: NextRequest) {
  const rateLimitRes = rateLimiter(req, 10, 15 * 60 * 1000);
  if (rateLimitRes) return rateLimitRes;

  try {
    await dbConnect();
    const body = await req.json();

    const { isValid, errorResponse } = validateFields(body, ['email', 'password']);
    if (!isValid) return errorResponse;

    const { email, password } = body;

    const admin = await Admin.findOne({ email: email.toLowerCase() }).select('+password');
    if (!admin) {
      return NextResponse.json(
        { success: false, error: 'Invalid email or password' },
        { status: 401 }
      );
    }

    if (!admin.isActive) {
      return NextResponse.json(
        { success: false, error: 'This admin account has been deactivated' },
        { status: 403 }
      );
    }

    const isMatch = await admin.comparePassword(password);
    if (!isMatch) {
      return NextResponse.json(
        { success: false, error: 'Invalid email or password' },
        { status: 401 }
      );
    }

    const token = signToken({
      id: admin._id.toString(),
      email: admin.email,
      role: admin.role,
    });

    return NextResponse.json({
      success: true,
      message: 'Admin login successful',
      admin: {
        id: admin._id,
        name: admin.name,
        email: admin.email,
        role: admin.role,
        isActive: admin.isActive,
      },
      token,
    });
  } catch (error: any) {
    return NextResponse.json(
      { success: false, error: error.message || 'Server error during admin login' },
      { status: 500 }
    );
  }
}