import { createFileRoute } from "@tanstack/react-router";
import { z } from "zod";
import nodemailer from "nodemailer";

const ContactSchema = z.object({
  nome: z.string().trim().min(2).max(120),
  empresa: z.string().trim().max(160).optional().default(""),
  email: z.string().trim().email().max(200),
  telefone: z.string().trim().max(40).optional().default(""),
  cidade: z.string().trim().max(120).optional().default(""),
  mensagem: z.string().trim().max(4000).optional().default(""),
  // honeypot — must be empty
  website: z.string().max(0).optional().default(""),
});

// naive in-memory rate limit (per instance)
const hits = new Map<string, { count: number; reset: number }>();
function rateLimit(ip: string, limit = 5, windowMs = 60_000) {
  const now = Date.now();
  const rec = hits.get(ip);
  if (!rec || rec.reset < now) {
    hits.set(ip, { count: 1, reset: now + windowMs });
    return true;
  }
  if (rec.count >= limit) return false;
  rec.count += 1;
  return true;
}

function esc(s: string) {
  return s.replace(/[&<>"']/g, (c) =>
    ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" }[c]!),
  );
}

export const Route = createFileRoute("/api/public/contact")({
  server: {
    handlers: {
      POST: async ({ request }) => {
        const ip =
          request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ||
          request.headers.get("x-real-ip") ||
          "unknown";
        if (!rateLimit(ip)) {
          return Response.json({ error: "rate_limited" }, { status: 429 });
        }

        let body: unknown;
        try {
          body = await request.json();
        } catch {
          return Response.json({ error: "invalid_json" }, { status: 400 });
        }

        const parsed = ContactSchema.safeParse(body);
        if (!parsed.success) {
          return Response.json({ error: "invalid_input" }, { status: 400 });
        }
        const data = parsed.data;
        if (data.website) {
          // honeypot triggered — pretend success
          return Response.json({ ok: true });
        }

        const host = process.env.SMTP_HOST || "smtp.gmail.com";
        const port = Number(process.env.SMTP_PORT || 465);
        const user = process.env.SMTP_USER;
        const pass = process.env.SMTP_PASS;
        const to = process.env.CONTACT_TO || "contato@consultingventurebuilder.com.br";
        const from = process.env.SMTP_FROM || user;

        if (!user || !pass) {
          console.error("SMTP credentials missing");
          return Response.json({ error: "server_misconfigured" }, { status: 500 });
        }

        const transporter = nodemailer.createTransport({
          host,
          port,
          secure: port === 465,
          auth: { user, pass },
        });

        const subject = `Novo contato pelo site — ${data.nome}${data.empresa ? ` (${data.empresa})` : ""}`;
        const rows: Array<[string, string]> = [
          ["Nome", data.nome],
          ["Empresa", data.empresa || "—"],
          ["E-mail", data.email],
          ["Telefone", data.telefone || "—"],
          ["Cidade", data.cidade || "—"],
          ["Mensagem", data.mensagem || "—"],
        ];
        const text = rows.map(([k, v]) => `${k}: ${v}`).join("\n");
        const html = `<div style="font-family:Inter,Arial,sans-serif;font-size:14px;color:#111">
          <h2 style="margin:0 0 16px">Novo contato pelo site CVB</h2>
          <table cellpadding="6" style="border-collapse:collapse">
            ${rows
              .map(
                ([k, v]) =>
                  `<tr><td style="border:1px solid #eee;background:#fafafa"><b>${esc(k)}</b></td><td style="border:1px solid #eee;white-space:pre-wrap">${esc(v)}</td></tr>`,
              )
              .join("")}
          </table>
          <p style="margin-top:16px;color:#666;font-size:12px">IP: ${esc(ip)}</p>
        </div>`;

        try {
          await transporter.sendMail({
            from,
            to,
            replyTo: `${data.nome} <${data.email}>`,
            subject,
            text,
            html,
          });
        } catch (err) {
          console.error("sendMail failed", err);
          return Response.json({ error: "send_failed" }, { status: 502 });
        }

        return Response.json({ ok: true });
      },
    },
  },
});