import { NextRequest, NextResponse } from "next/server";
import { z } from "zod";
import { prisma } from "@/lib/prisma";
import { createPasswordResetToken } from "@/lib/password-reset";
import { sendPasswordResetEmail } from "@/lib/email";
import { resolveBaseUrl } from "@/lib/base-url";

const bodySchema = z.object({ email: z.string().email() });

export async function POST(req: NextRequest) {
  const parsed = bodySchema.safeParse(await req.json().catch(() => null));
  if (!parsed.success) {
    return NextResponse.json({ error: "Email invalide." }, { status: 400 });
  }

  const user = await prisma.user.findUnique({ where: { email: parsed.data.email } });

  // Réponse identique que le compte existe ou non, pour ne pas révéler les emails inscrits.
  if (user) {
    const token = await createPasswordResetToken(user.id);
    const base = await resolveBaseUrl(req);
    const resetUrl = `${base}/reinitialiser-mot-de-passe?token=${token}`;
    await sendPasswordResetEmail({ to: user.email, resetUrl });
  }

  return NextResponse.json({ ok: true });
}