"use server";

import { redirect } from "next/navigation";
import { z } from "zod";
import { sendVerification } from "@/actions/email-verify";
import { hashPassword } from "@/lib/auth/password";
import { prisma } from "@/lib/prisma";
import { clientIp, rateLimit } from "@/lib/rate-limit";
import { captchaConfig, verifyCaptcha } from "@/lib/services/captcha";
import { checkVpn } from "@/lib/services/ip-lookup";
import { siteSettings } from "@/lib/services/site-settings";

const registerSchema = z.object({
  username: z
    .string()
    .min(3, "Username must be at least 3 characters")
    .max(25, "Username must be at most 25 characters")
    .regex(/^[A-Za-z0-9_\-=?!@:.,]+$/, "Username contains invalid characters"),
  mail: z.string().email("Enter a valid email address").optional().or(z.literal("")),
  password: z
    .string()
    .min(8, "Password must be at least 8 characters")
    .regex(/[A-Z]/, "Password must contain at least one uppercase letter")
    .regex(/[a-z]/, "Password must contain at least one lowercase letter")
    .regex(/[0-9]/, "Password must contain at least one digit"),
  look: z.string().optional(),
});

// A valid starter Habbo figure so the avatar renders in-client immediately.
const DEFAULT_LOOK = "hr-100-.hd-180-1.ch-255-66.lg-280-110.sh-305-62";

export async function register(prevState: string | null, formData: FormData): Promise<string | null> {
  const raw = {
    username: String(formData.get("username") ?? "").trim(),
    mail: String(formData.get("mail") ?? "").trim().toLowerCase(),
    password: String(formData.get("password") ?? ""),
    look: String(formData.get("look") ?? "").trim() || DEFAULT_LOOK,
  };

  const parsed = registerSchema.safeParse(raw);
  if (!parsed.success) {
    return parsed.error.errors[0]?.message ?? "Invalid input";
  }

  const { username, mail, password, look } = parsed.data;
  const hasEmail = !!mail;
  const ip = await clientIp();

  // Throttle sign-ups per IP (5 per 10 minutes) to curb account spam.
  if (!rateLimit(`register:${ip}`, 5, 10 * 60_000).ok) {
    return "Too many sign-up attempts. Please wait a few minutes and try again.";
  }

  // CAPTCHA (Turnstile / reCAPTCHA) — only enforced when configured in settings.
  const cfg = await captchaConfig();
  if (cfg.provider !== "none") {
    const token = String(formData.get(cfg.field) ?? "");
    if (!(await verifyCaptcha(token, ip))) return "Captcha verification failed. Please try again.";
  }

  // VPN/proxy block (only when enabled in /admin/vpn).
  if ((await checkVpn(ip)).blocked) {
    return (
      await siteSettings.get("vpn_block_message", "")
    ) || "Registrations from VPN/proxy connections are not allowed.";
  }

  // Max accounts per IP (0 / unset = unlimited), mirrors AtomCMS.
  const max = Number(await siteSettings.get("max_accounts_per_ip", "0")) || 0;
  if (max > 0) {
    const count = await prisma.user.count({ where: { ipRegister: ip } }).catch(() => 0);
    if (count >= max) return "You have reached the maximum number of accounts for your connection.";
  }

  // Uniqueness check.
  try {
    const existing = await prisma.user.findUnique({
      where: { username },
      select: { id: true },
    });
    if (existing) return "That username is already taken";
  } catch {
    return "Registration is temporarily unavailable";
  }

  const now = Math.floor(Date.now() / 1000);
  try {
    const created = await prisma.user.create({
      data: {
        username,
        password: await hashPassword(password),
        mail: hasEmail ? mail : null,
        accountCreated: now,
        ipRegister: ip,
        ipCurrent: ip,
        look,
      },
      select: { id: true },
    });

    if (hasEmail) {
      try {
        await sendVerification(created.id, mail);
      } catch {
        // No-op: account is created; user can request a new link later.
      }
    }
  } catch {
    return "Could not create the account (is the username unique?)";
  }

  if (hasEmail) {
    redirect("/login?registered=1");
  } else {
    const { signIn } = await import("@/lib/auth");
    await signIn("credentials", { username, password, redirect: false });
    redirect("/verify?method=discord");
  }
}