import { NextRequest, NextResponse } from 'next/server';
export const dynamic = 'force-dynamic';
import { compare } from 'bcryptjs';

export async function POST(request: NextRequest) {
  try {
    const { email, password } = await request.json();

    // Basic validation
    if (!email || !password) {
      return NextResponse.json(
        { error: 'Email and password are required' },
        { status: 400 }
      );
    }

    // In a real app, you would fetch user from database here
    // For now, we'll simulate a user lookup
    console.log('Attempting to login user with email:', email);
    
    // Simulate database lookup
    const mockStoredPassword = '$2b$10$examplehashedpassword'; // This would come from DB
    
    // Compare passwords
    const isValid = await compare(password, mockStoredPassword);
    
    if (!isValid) {
      return NextResponse.json(
        { error: 'Invalid email or password' },
        { status: 401 }
      );
    }

    // Create a mock JWT token (in a real app, you would use a proper JWT library)
    const token = `mock-jwt-token-${Date.now()}`;
    
    // Set cookie
    const response = NextResponse.json({ message: 'Login successful' });
    response.cookies.set('auth_token', token, {
      httpOnly: true,
      maxAge: 15 * 60, // 15 minutes
      path: '/',
      secure: process.env.NODE_ENV === 'production',
      sameSite: 'strict'
    });

    return response;
  } catch (error) {
    console.error('Login error:', error);
    return NextResponse.json(
      { error: 'Internal server error' },
      { status: 500 }
    );
  }
}