"use client";

import { useRef, useState } from "react";
import Link from "next/link";
import { useRouter, useSearchParams } from "next/navigation";
import { Loader2 } from "lucide-react";
import { toast } from "sonner";
import { Button } from "@/components/ui/button";
import { Input } from "@/components/ui/input";
import { Label } from "@/components/ui/label";
import { Card, CardContent, CardHeader, CardTitle, CardDescription } from "@/components/ui/card";
import { signIn } from "@/lib/auth/auth-client";
import { safeRedirect } from "@/lib/utils";
import { GoogleButton } from "./google-button";
import { Turnstile, type TurnstileHandle } from "./turnstile";

export function SignInForm({
  googleEnabled,
  turnstileSiteKey,
}: {
  googleEnabled: boolean;
  turnstileSiteKey: string | null;
}) {
  const router = useRouter();
  const params = useSearchParams();
  // Validate the ?redirect param to prevent open-redirect attacks.
  const redirectTo = safeRedirect(params.get("redirect"));
  const [loading, setLoading] = useState(false);
  // Turnstile is only rendered when configured; when it is, a solved token is
  // required before the form can be submitted. The server rejects a missing or
  // reused token regardless, so this is UX, not the security boundary.
  const [captchaToken, setCaptchaToken] = useState("");
  const turnstileRef = useRef<TurnstileHandle>(null);
  const captchaRequired = !!turnstileSiteKey;

  async function onSubmit(e: React.FormEvent<HTMLFormElement>) {
    e.preventDefault();
    setLoading(true);
    const form = new FormData(e.currentTarget);
    const { error } = await signIn.email(
      {
        email: String(form.get("email")),
        password: String(form.get("password")),
      },
      captchaRequired ? { headers: { "x-captcha-response": captchaToken } } : undefined
    );
    if (error) {
      // Turnstile tokens are single-use — issue a fresh challenge for the retry,
      // otherwise the next submit fails verification instead of on credentials.
      turnstileRef.current?.reset();
      toast.error(error.message ?? "Invalid email or password");
      setLoading(false);
      return;
    }
    router.push(redirectTo);
    router.refresh();
  }

  return (
    <Card className="rounded-3xl shadow-md">
      <CardHeader className="pb-2">
        <CardTitle className="text-2xl">Welcome back</CardTitle>
        <CardDescription>Sign in to your Podcast Distribution AI account.</CardDescription>
      </CardHeader>
      <CardContent className="space-y-4">
        {googleEnabled && (
          <>
            <GoogleButton callbackURL={redirectTo} />
            <div className="relative">
              <div className="absolute inset-0 flex items-center">
                <span className="w-full border-t" />
              </div>
              <div className="relative flex justify-center text-xs uppercase">
                <span className="bg-card px-2 text-muted-foreground">or</span>
              </div>
            </div>
          </>
        )}
        <form onSubmit={onSubmit} className="space-y-4">
          <div className="space-y-2">
            <Label htmlFor="email">Email</Label>
            <Input id="email" name="email" type="email" autoComplete="email" required />
          </div>
          <div className="space-y-2">
            <div className="flex items-center justify-between">
              <Label htmlFor="password">Password</Label>
              <Link href="/forgot-password" className="text-xs text-muted-foreground hover:text-foreground">
                Forgot?
              </Link>
            </div>
            <Input id="password" name="password" type="password" autoComplete="current-password" required />
          </div>
          {turnstileSiteKey && (
            <Turnstile
              ref={turnstileRef}
              siteKey={turnstileSiteKey}
              onToken={setCaptchaToken}
              onError={() => toast.error("Could not load the security check. Please refresh.")}
              className="flex justify-center"
            />
          )}
          <Button
            type="submit"
            className="w-full"
            disabled={loading || (captchaRequired && !captchaToken)}
          >
            {loading && <Loader2 className="h-4 w-4 animate-spin" />}
            Sign in
          </Button>
        </form>
        <p className="text-center text-sm text-muted-foreground">
          Don&apos;t have an account?{" "}
          <Link href="/sign-up" className="font-semibold text-brand hover:underline">
            Sign up
          </Link>
        </p>
      </CardContent>
    </Card>
  );
}