import { APIError } from "better-auth/api";
import * as z from "zod";
import { getAuth, getCustomerSession } from "@/lib/auth/server";
import { errorResponse, HttpError, readJson, requireSameOrigin } from "@/lib/security/http";
import { limitRequest } from "@/lib/security/rate-limit";

export async function POST(request: Request) {
  try {
    requireSameOrigin(request);
    const session = await getCustomerSession();
    if (!session) throw new HttpError(401, "unauthorized");
    await limitRequest("password-set", session.user.id, 5, 3600);
    const parsed = z.object({ newPassword: z.string().min(6).max(128) })
      .safeParse(await readJson(request, 1024));
    if (!parsed.success) throw new HttpError(400, "invalid-password");
    await getAuth().api.setPassword({ headers: request.headers, body: parsed.data });
    return new Response(null, { status: 204, headers: { "Cache-Control": "no-store" } });
  } catch (cause) {
    if (cause instanceof APIError) {
      const error = typeof cause.body?.code === "string" ? cause.body.code : "password-setting-failed";
      return Response.json({ error }, {
        status: cause.statusCode || 400,
        headers: { "Cache-Control": "no-store" },
      });
    }
    return errorResponse(cause);
  }
}