import { NextResponse } from "next/server";
import { currentUser } from "@/lib/auth";
import { checkRateLimit, readJson } from "@/lib/api-security";
import { normalizePhone, PhoneVerificationError, verifyPhoneChallenge } from "@/lib/sms-pin";

export async function POST(request: Request) {
  const user = await currentUser();
  if (!user) return NextResponse.json({ error: "unauthorized" }, { status: 401 });
  try {
    checkRateLimit(request, "sms-verify", 20, 10 * 60 * 1000);
    const body = await readJson<{ phone?: unknown; code?: unknown }>(request, 4 * 1024);
    const phone = normalizePhone(typeof body.phone === "string" ? body.phone : "");
    const code = typeof body.code === "string" ? body.code.replace(/\D/g, "") : "";
    if (!phone || code.length < 4 || code.length > 10) return NextResponse.json({ error: "bad_request", message: "Проверьте номер и код." }, { status: 400 });
    await verifyPhoneChallenge({ userId: user.id, phone, pin: code });
    return NextResponse.json({ ok: true }, { headers: { "Cache-Control": "no-store" } });
  } catch (error) {
    if (error instanceof PhoneVerificationError) return NextResponse.json({ error: "verify_failed", message: error.message }, { status: 400 });
    return NextResponse.json({ error: "verify_failed", message: "Не удалось проверить код. Попробуйте позже." }, { status: 503 });
  }
}