import { redirect } from '@sveltejs/kit';
import { building } from '$app/environment';

const API_BASE = building ? 'http://localhost:8080/api' : '/api';

export async function load({ cookies }) {
	const token = cookies.get('auth_token');
	if (token) {
		const res = await fetch(`${API_BASE}/auth/verify`, {
			headers: { Authorization: `Bearer ${token}` }
		});
		if (res.ok) {
			throw redirect(302, '/admin');
		}
	}
	return {};
}

export const actions = {
	default: async ({ request, cookies }) => {
		const data = await request.formData();
		const username = data.get('username');
		const password = data.get('password');

		if (!username || !password) {
			return { error: 'Preencha todos os campos' };
		}

		const res = await fetch(`${API_BASE}/auth/login`, {
			method: 'POST',
			headers: { 'Content-Type': 'application/json' },
			body: JSON.stringify({ username, password })
		});

		if (!res.ok) {
			const err = await res.json().catch(() => ({}));
			return { error: err.error || 'Credenciais inválidas' };
		}

		const { token } = await res.json();

		cookies.set('auth_token', token, {
			httpOnly: true,
			secure: process.env.NODE_ENV === 'production',
			sameSite: 'lax',
			path: '/',
			maxAge: 7 * 24 * 60 * 60
		});

		throw redirect(302, '/admin');
	}
};