import { NextResponse } from "next/server";
import { headers } from "next/headers";
import { auth } from "@/lib/auth/server";
import { db, users, eq } from "@epicure/db";
import { z } from "zod";
import { gravatarUrl } from "@/lib/gravatar";
import { USERNAME_PATTERN, isUsernameTaken } from "@/lib/username";

const PatchSchema = z.object({
  name: z.string().min(1).max(100).optional(),
  locale: z.string().max(10).optional(),
  bio: z.string().max(500).optional().nullable(),
  privateBio: z.string().max(2000).optional().nullable(),
  isPrivate: z.boolean().optional(),
  username: z.string().trim().toLowerCase().regex(USERNAME_PATTERN, "3-20 characters, lowercase letters, numbers, and underscores only").optional(),
  // A custom-uploaded avatar URL, or null to revert to the Gravatar fallback.
  avatarUrl: z.string().url().max(2048).optional().nullable(),
});

export async function PATCH(req: Request) {
  const session = await auth.api.getSession({ headers: await headers() });
  if (!session) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });

  const body = PatchSchema.safeParse(await req.json());
  if (!body.success) return NextResponse.json({ error: body.error.flatten() }, { status: 400 });

  if (body.data.username !== undefined && (await isUsernameTaken(body.data.username, session.user.id))) {
    return NextResponse.json({ error: "Username already taken" }, { status: 409 });
  }

  const { avatarUrl, ...rest } = body.data;
  const updates: Partial<typeof users.$inferInsert> = { ...rest };
  if (avatarUrl !== undefined) {
    if (avatarUrl === null) {
      updates.avatarUrl = gravatarUrl(session.user.email);
      updates.hasCustomAvatar = false;
    } else {
      updates.avatarUrl = avatarUrl;
      updates.hasCustomAvatar = true;
    }
  }

  await db.update(users).set(updates).where(eq(users.id, session.user.id));
  return NextResponse.json({ ok: true, avatarUrl: updates.avatarUrl });
}