import { NextRequest, NextResponse } from "next/server";
import { db } from "@/lib/db";

export const dynamic = "force-dynamic";

// Demo auth: looks up user by email. (Production would verify Argon2id hash + issue session.)
export async function POST(req: NextRequest) {
  const { email, password } = await req.json().catch(() => ({}));
  if (!email || !password) {
    return NextResponse.json({ error: "ایمیل و رمز عبور الزامی است" }, { status: 400 });
  }
  const user = await db.user.findUnique({
    where: { email: String(email).toLowerCase().trim() },
    include: { wallet: true, subscriptions: { include: { plan: true }, orderBy: { createdAt: "desc" }, take: 1 } },
  });
  if (!user) {
    return NextResponse.json({ error: "کاربر یافت نشد" }, { status: 404 });
  }
  const activeSub = user.subscriptions.find((s) => s.status === "active");
  return NextResponse.json({
    user: {
      id: user.id,
      name: user.name,
      email: user.email,
      role: user.role,
      plan: user.plan,
      planName: activeSub?.plan.persianName ?? "رایگان",
      avatar: user.avatar,
      isAdmin: user.role === "admin",
      referralCode: user.referralCode,
      walletBalance: user.wallet?.balance ?? 0,
    },
  });
}