import { NextResponse } from "next/server";
import { eq } from "drizzle-orm";
import { db } from "@/db";
import { accountLifecycleEvents, authUsers } from "@/db/schema";
import { currentUser } from "@/lib/auth";
import { readJson } from "@/lib/api-security";

function sameOrigin(request: Request) {
  if (request.headers.get("sec-fetch-site") === "cross-site") return false;
  const origin = request.headers.get("origin");
  if (!origin) return request.headers.get("sec-fetch-site") === "same-origin";
  const host = request.headers.get("x-forwarded-host")?.split(",")[0]?.trim() || request.headers.get("host");
  try { return Boolean(host && new URL(origin).host === host); } catch { return false; }
}

export async function PATCH(request: Request) {
  const user = await currentUser();
  if (!user) return NextResponse.json({ error: "unauthorized" }, { status: 401 });
  if (!sameOrigin(request)) return NextResponse.json({ error: "forbidden" }, { status: 403 });
  if (!db) return NextResponse.json({ error: "service_unavailable" }, { status: 503 });
  const body = await readJson<{ name?: unknown }>(request, 2 * 1024);
  const name = typeof body.name === "string" ? body.name.trim().replace(/\s+/g, " ") : "";
  if (name.length < 2 || name.length > 64) return NextResponse.json({ error: "bad_name", message: "Имя должно содержать от 2 до 64 символов." }, { status: 400 });
  const now = new Date();
  await db.transaction(async (tx) => {
    await tx.update(authUsers).set({ displayName: name, suggestedDisplayName: null, profileCompletedAt: now, updatedAt: now }).where(eq(authUsers.id, user.id));
    await tx.insert(accountLifecycleEvents).values({ userId: user.id, customerRef: user.customerRef, eventType: user.profileCompletedAt ? "profile_name_changed" : "profile_completed", actorType: "customer", actorId: String(user.id) });
  });
  return NextResponse.json({ ok: true, name }, { headers: { "Cache-Control": "no-store" } });
}