import { NextRequest, NextResponse } from "next/server";
import prisma from "@/app/prisma";
import jwt from "jsonwebtoken";
import bcrypt from "bcryptjs";

interface Body {
    token: string;
    old_password: string;
    password: string;
}

export async function POST(request: NextRequest) {
    try {
        const body: Body = await request.json();

        if (!body.token || !body.old_password || !body.password) {
            return NextResponse.json({ error: "Missing required fields" }, { status: 400 });
        }

        if(!process.env.JWT_SECRET) {
            return NextResponse.json({ error: "No JWT secret found" }, { status: 500 });
        }

        const decoded = jwt.verify(body.token, process.env.JWT_SECRET) as { id: string };

        const user = await prisma.user.findUnique({
            where: {
                id: decoded.id,
            },
        });

        if (!user) {
            return NextResponse.json({ error: "User not found" }, { status: 404 });
        }

        const validPassword = await bcrypt.compare(body.old_password, user.password);

        if (!validPassword) {
            return NextResponse.json({ error: "Invalid password" }, { status: 401 });
        }

        const hashedPassword = await bcrypt.hash(body.password, 10);

        await prisma.user.update({
            where: {
                id: decoded.id,
            },
            data: {
                password: hashedPassword,
            },
        });

        return NextResponse.json({ message: "Password updated successfully" }, { status: 200 });
    } catch (error: any) {
        return NextResponse.json({ error: "Internal Server Error" }, { status: 500 });
    }
}

