export const refresh_tokens = pgTable("refresh_tokens", {
    id: serial('id').notNull(),
    user_id: integer().notNull(),
    username: varchar().notNull(),
    refresh_token: varchar('refresh_token').notNull().primaryKey(),
    ip_adress: varchar(),
    revoked: boolean().default(false).notNull(),
    expires_at: timestamp().notNull(),
    issued_at: timestamp().notNull().defaultNow()
});

import { db } from "@/lib/db";
import { refresh_tokens, users } from "@/lib/schema";
import { eq } from "drizzle-orm";
import { NextResponse } from "next/server";
import * as jwt from "jsonwebtoken";

const JWT_RT_SECRET = process.env.JWT_RT_SECRET as string;

export async function POST(req: Request) {
  const body = await req.json();
  const { refresh_token } = body;

  if (!refresh_token) {
    return NextResponse.json({ error: "Refresh token is required" }, { status: 400 });
  }

  let decoded;
  try {
    decoded = jwt.verify(refresh_token, JWT_RT_SECRET);
  } catch {
    return NextResponse.json({ error: "Invalid Refresh Token" }, { status: 403 });
  }

  const currentToken = await db.query.refresh_tokens.findFirst({
    where: eq(refresh_tokens.username, decoded.username),
  });

  if (!currentToken) {
    return NextResponse.json({ error: "Refresh token not found" }, { status: 403 });
  }

  const isTokenValid = await Bun.password.verify(refresh_token, currentToken.refresh_token);
  if (!isTokenValid) {
    return NextResponse.json({ error: "Invalid Refresh Token" }, { status: 403 });
  }

  const user = await db.query.users.findFirst({
    where: eq(users.username, decoded.username)
  });
  
    const access_token = jwt.sign({
        username: user?.username,
        title: user?.title,
        perm: user?.permission
    }, process.env.JWT_AT_SECRET as string, { expiresIn: '1h' });

  return NextResponse.json({ access_token: access_token }, { status: 200 });
};