import bcrypt from 'bcryptjs'
import { db, eq, users } from '~/drizzle/db'
import { JWTEnhanced } from '~~/server/utils/jwt-enhanced'
import { createAuthSession } from '~~/server/utils/create-auth-session'
import { emailVerificationCodes } from '~~/server/api/user/email/send-code.post'

export default defineEventHandler(async (event) => {
  const body = await readBody(event)

  if (!body.username || !body.password) {
    throw createError({
      statusCode: 400,
      message: '姓名/用户名和密码不能为空'
    })
  }

  // 验证姓名/用户名只能包含汉字
  const chineseRegex = /^[\u4e00-\u9fa5]+$/
  if (!chineseRegex.test(body.username)) {
    throw createError({
      statusCode: 400,
      message: '姓名/用户名只能包含汉字'
    })
  }

  const rawEmail = typeof body.email === 'string' ? body.email.trim() : ''
  const email = rawEmail ? rawEmail.toLowerCase() : null
  
  if (email) {
    const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/
    if (!emailRegex.test(email)) {
      throw createError({
        statusCode: 400,
        message: '邮箱格式不正确'
      })
    }

    const existingEmailUser = await db
      .select({ id: users.id })
      .from(users)
      .where(eq(users.email, email))
      .limit(1)

    if (existingEmailUser.length > 0) {
      throw createError({
        statusCode: 409,
        message: '邮箱已被绑定'
      })
    }

    // 验证验证码
    if (!body.emailCode) {
      throw createError({
        statusCode: 400,
        message: '请提供邮箱验证码'
      })
    }

    const storedData = emailVerificationCodes.get(email)
    if (!storedData) {
      throw createError({ statusCode: 400, message: '请先获取邮箱验证码' })
    }
    if (Date.now() > storedData.expiresAt) {
      emailVerificationCodes.delete(email)
      throw createError({ statusCode: 400, message: '验证码已过期，请重新获取' })
    }
    if (storedData.code !== body.emailCode.trim()) {
      throw createError({ statusCode: 400, message: '邮箱验证码不正确' })
    }
  }

  // 验证用户名唯一性
  const existingUser = await db
    .select({ id: users.id })
    .from(users)
    .where(eq(users.username, body.username))
    .limit(1)

  if (existingUser.length > 0) {
    throw createError({
      statusCode: 409,
      message: '用户名已被注册'
    })
  }

  // 加密密码
  const saltRounds = 10
  const hashedPassword = await bcrypt.hash(body.password, saltRounds)

  // 插入新用户
  const [newUser] = await db.insert(users).values({
    username: body.username,
    name: body.username, // 默认将昵称设置为账号名
    password: hashedPassword,
    email,
    emailVerified: !!email, // 邮箱存在则表示已验证
    grade: body.grade || null,
    class: body.class || null,
    studentId: body.studentId || null,
    role: 'USER',
    status: 'active'
  }).returning({
    id: users.id,
    username: users.username,
    role: users.role
  })

  if (email) {
    emailVerificationCodes.delete(email)
  }

  // 签发 JWT Token
  const { token, jti } = JWTEnhanced.generateTokenWithJti(newUser.id, newUser.role)
  await createAuthSession(event, { userId: newUser.id, jti, loginMethod: 'password' })

  const isSecure =
    getRequestURL(event).protocol === 'https:' ||
    getRequestHeader(event, 'x-forwarded-proto') === 'https'

  setCookie(event, 'auth-token', token, {
    httpOnly: true,
    secure: isSecure,
    sameSite: 'lax',
    maxAge: 60 * 60 * 24 * 7, // 7天
    path: '/'
  })

  return {
    success: true,
    user: {
      id: newUser.id,
      username: newUser.username,
      role: newUser.role
    }
  }
})