import { NextResponse } from 'next/server';
import { ADMIN_COOKIE, cookieOptions, hashToken, safeNextPath, verifyToken } from '@/lib/admin-auth';

export const dynamic = 'force-dynamic';

/** Login form target: compares the posted token with SI_ADMIN_TOKEN server-side and sets the httpOnly session cookie. */
export async function POST(req: Request): Promise<Response> {
  const form = await req.formData().catch(() => null);
  const token = typeof form?.get('token') === 'string' ? String(form.get('token')).trim() : '';
  const next = safeNextPath(typeof form?.get('next') === 'string' ? String(form.get('next')) : null);
  if (!verifyToken(token)) {
    const url = new URL('/admin/login', req.url);
    url.searchParams.set('error', process.env.SI_ADMIN_TOKEN ? 'invalid' : 'unconfigured');
    if (next !== '/admin') url.searchParams.set('next', next);
    return NextResponse.redirect(url, 303);
  }
  const res = NextResponse.redirect(new URL(next, req.url), 303);
  res.cookies.set(ADMIN_COOKIE, hashToken(token), cookieOptions());
  return res;
}