// HOST-Konten: Registrierung + Login. Gibt ein JWT zurück.
import { Router } from "express";
import { one } from "../db.js";
import { hashPassword, verifyPassword, signToken, ensureAdminFlag } from "../auth.js";

export const authRouter = Router();

const isEmail = (s) => /.+@.+\..+/.test(s || "");

authRouter.post("/register", async (req, res) => {
  const { email, password } = req.body || {};
  if (!isEmail(email)) return res.status(400).json({ error: "Ungültige Email." });
  if (!password || password.length < 8) return res.status(400).json({ error: "Passwort min. 8 Zeichen." });

  const existing = await one("select id from accounts where email = $1", [email.toLowerCase()]);
  if (existing) return res.status(409).json({ error: "Konto existiert bereits." });

  const account = await one(
    "insert into accounts (email, password_hash) values ($1, $2) returning id, email",
    [email.toLowerCase(), await hashPassword(password)]
  );
  res.json({ token: signToken(account), account: { id: account.id, email: account.email } });
});

authRouter.post("/login", async (req, res) => {
  const { email, password } = req.body || {};
  const account = await one("select id, email, password_hash from accounts where email = $1", [
    (email || "").toLowerCase(),
  ]);
  if (!account || !(await verifyPassword(password || "", account.password_hash))) {
    return res.status(401).json({ error: "Email oder Passwort falsch." });
  }
  res.json({ token: signToken(account), account: { id: account.id, email: account.email } });
});