import { NextRequest, NextResponse } from "next/server";
import { db } from "@/db";
import { providers } from "@/db/schema";
import { eq } from "drizzle-orm";
import { compare } from "bcryptjs";
import { createSession } from "@/lib/auth";

export async function POST(request: NextRequest) {
  try {
    const { email, password } = await request.json();

    const [provider] = await db
      .select()
      .from(providers)
      .where(eq(providers.email, email))
      .limit(1);

    if (!provider) {
      return NextResponse.json({ error: "Invalid credentials" }, { status: 401 });
    }

    const valid = await compare(password, provider.passwordHash);
    if (!valid) {
      return NextResponse.json({ error: "Invalid credentials" }, { status: 401 });
    }

    const token = await createSession({
      providerId: provider.id,
      email: provider.email,
      firstName: provider.firstName,
      lastName: provider.lastName,
      specialty: provider.specialty,
      role: provider.role,
    });

    const response = NextResponse.json({
      success: true,
      provider: {
        id: provider.id,
        firstName: provider.firstName,
        lastName: provider.lastName,
        specialty: provider.specialty,
        role: provider.role,
      },
    });

    response.cookies.set("session", token, {
      httpOnly: true,
      secure: process.env.NODE_ENV === "production",
      sameSite: "lax",
      maxAge: 86400,
      path: "/",
    });

    return response;
  } catch {
    return NextResponse.json({ error: "Internal server error" }, { status: 500 });
  }
}