import { NextResponse } from "next/server";
import { currentUser } from "@/lib/auth";
import { checkRateLimit, readJson } from "@/lib/api-security";
import { normalizePhone, PhoneVerificationError, requestPhoneChallenge } from "@/lib/sms-pin";

export async function POST(request: Request) {
  const user = await currentUser();
  if (!user) return NextResponse.json({ error: "unauthorized" }, { status: 401 });
  try {
    // §10.2: no more than 3 sends per hour per IP besides per-number limits.
    checkRateLimit(request, "sms-pin", 3, 60 * 60 * 1000);
    const body = await readJson<{ phone?: unknown }>(request, 4 * 1024);
    const phone = normalizePhone(typeof body.phone === "string" ? body.phone : "");
    if (!phone) return NextResponse.json({ error: "bad_request", message: "Проверьте номер телефона." }, { status: 400 });
    await requestPhoneChallenge({ userId: user.id, phone, ip: request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() || undefined });
    // Never disclose whether the number already exists in the system.
    return NextResponse.json({ ok: true, message: "Код отправлен по SMS." }, { headers: { "Cache-Control": "no-store" } });
  } catch (error) {
    if (error instanceof PhoneVerificationError) return NextResponse.json({ error: "rate_limited", message: error.message }, { status: error.status });
    return NextResponse.json({ error: "sms_unavailable", message: "Не удалось отправить SMS. Попробуйте позже." }, { status: 502 });
  }
}