const express = require('express');
const bcrypt = require('bcryptjs');
const db = require('../db');
require('dotenv').config();

const router = express.Router();

// Nur vom FiveM-Server erreichbar (interner Key)
function requireInternal(req, res, next) {
    const key = req.headers['x-internal-key'];
    if (!key || key !== process.env.INTERNAL_API_KEY) {
        return res.status(403).json({ error: 'forbidden' });
    }
    next();
}

// POST /internal/set-password  {charId, password}
// Wird ingame vom Spieler ausgeloest; Passwort wird hier gehasht gespeichert.
router.post('/set-password', requireInternal, async (req, res) => {
    try {
        const charId = String((req.body && req.body.charId) || '').trim();
        const password = String((req.body && req.body.password) || '');
        if (!charId) return res.status(400).json({ error: 'missing_char' });
        if (password.length < 6) return res.status(400).json({ error: 'password_too_short' });

        const account = await db.q1('SELECT id FROM bleeter_accounts WHERE char_id = ?', [charId]);
        if (!account) return res.status(404).json({ error: 'no_account' });

        const hash = await bcrypt.hash(password, 10);
        await db.exec(
            'UPDATE bleeter_accounts SET web_password_hash = ?, web_password_updated_at = NOW() WHERE id = ?',
            [hash, account.id]
        );
        res.json({ ok: true });
    } catch (err) {
        console.error('[bleeter] set-password error', err.message);
        res.status(500).json({ error: 'server_error' });
    }
});

module.exports = router;