import { NextResponse } from "next/server";
import { authErrorMessage } from "@/lib/api/auth-errors";
import { readJsonBody } from "@/lib/api/security";
import { createRouteClient } from "@/lib/supabase/route";

export async function POST(req: Request) {
  const body = await readJsonBody<{ email?: unknown }>(req);

  if (!body || typeof body.email !== "string") {
    return NextResponse.json({ error: "Keine E-Mail angegeben" }, { status: 400 });
  }

  try {
    const supabase = await createRouteClient();
    const { error } = await supabase.auth.resetPasswordForEmail(body.email.trim(), {
      redirectTo: new URL("/reset-password", new URL(req.url).origin).toString(),
    });

    if (error) {
      const authError = authErrorMessage(error);
      return NextResponse.json({ error: authError.message }, { status: authError.status });
    }

    return NextResponse.json({ ok: true });
  } catch {
    return NextResponse.json(
      { error: "Der Auth-Dienst ist gerade nicht erreichbar. Prüfe Internet/DNS und die Supabase-Projekt-URL." },
      { status: 503 },
    );
  }
}