import { login, sessionCookie } from "../../../../server/auth.ts";
import { boundedFormData, safeReturnTo } from "../../../../server/security.ts";
import { publicUrl, audit } from "../../../../lib/admin-operations";
export async function POST(request: Request) {
  try {
    const form = await boundedFormData(request),
      username = String(form.get("username") || "").slice(0, 100),
      password = String(form.get("password") || "").slice(0, 1024),
      returnTo = safeReturnTo(String(form.get("return_to") || ""));
    const session = await login(username, password);
    if (!session)
      return Response.redirect(
        publicUrl(
          request,
          `/administracao/login?error=1&return_to=${encodeURIComponent(returnTo)}`,
        ),
        303,
      );
    await audit(session.userId, "ADMIN_LOGIN", "SESSION", session.userId);
    return new Response(null, {
      status: 303,
      headers: {
        Location: publicUrl(request, returnTo).toString(),
        "Set-Cookie": sessionCookie(session.token, session.expires),
        "Cache-Control": "no-store",
      },
    });
  } catch {
    return Response.json({ error: "unavailable" }, { status: 503 });
  }
}