import { NextResponse } from "next/server";
import bcrypt from "bcryptjs";
import { prisma } from "@/lib/prisma";

export async function POST(req: Request) {
  const { name, email, password, token } = await req.json();

  if (!name || !email || !password || !token) {
    return NextResponse.json({ error: "Champs requis manquants" }, { status: 400 });
  }

  const invite = await prisma.pendingInvite.findUnique({ where: { token } });
  if (!invite) return NextResponse.json({ error: "Lien d'invitation invalide" }, { status: 404 });
  if (invite.expiresAt < new Date()) return NextResponse.json({ error: "Lien d'invitation expiré" }, { status: 410 });

  const existing = await prisma.user.findUnique({ where: { email } });
  if (existing) return NextResponse.json({ error: "Email déjà utilisé" }, { status: 409 });

  const hashed = await bcrypt.hash(password, 12);
  const user = await prisma.user.create({
    data: { name, email, password: hashed, familyId: invite.familyId, role: invite.role },
  });

  await prisma.pendingInvite.delete({ where: { token } });

  return NextResponse.json({ id: user.id, email: user.email, name: user.name, role: user.role });
}