'use server';

import { headers } from 'next/headers';
import { redirect } from 'next/navigation';
import { verifyCredentials, getConfiguredUsername } from '@/lib/auth';
import { createSession } from '@/lib/session';
import { checkRateLimit } from '@/lib/ratelimit';

export async function login(
  _prevState: { error: string } | undefined,
  formData: FormData
): Promise<{ error: string }> {
  const headersList = await headers();
  const ip =
    headersList.get('x-forwarded-for')?.split(',')[0].trim() ??
    headersList.get('x-real-ip') ??
    'unknown';

  const { allowed, remainingMs } = checkRateLimit(ip);
  if (!allowed) {
    const minutes = Math.ceil(remainingMs / 60000);
    return { error: `Zu viele Anmeldeversuche. Bitte ${minutes} Minute${minutes !== 1 ? 'n' : ''} warten.` };
  }

  const username = (formData.get('username') as string)?.trim();
  const password = formData.get('password') as string;

  if (!username || !password) {
    return { error: 'Bitte Benutzer und Passwort eingeben.' };
  }

  if (!verifyCredentials(username, password)) {
    return { error: 'Ungültiger Benutzer oder Passwort.' };
  }

  await createSession({
    username: getConfiguredUsername(),
    isAuthenticated: true,
  });

  redirect('/');
}