import { NextResponse } from "next/server";
import { prisma } from "@/lib/prisma";
import { sha256 } from "@/lib/security";

export async function GET(request: Request) {
  const token = new URL(request.url).searchParams.get("token") ?? "";
  const record = await prisma.emailVerification.findUnique({ where: { tokenHash: sha256(token) } });
  const base = (process.env.NEXT_PUBLIC_SITE_URL ?? "https://toolaro.org").replace(/\/$/, "");
  if (!record || record.usedAt || record.expiresAt <= new Date()) {
    return NextResponse.redirect(`${base}/email-confirmed?status=invalid`);
  }

  await prisma.$transaction([
    prisma.emailVerification.update({ where: { id: record.id }, data: { usedAt: new Date() } }),
    prisma.user.update({ where: { id: record.userId }, data: { emailVerifiedAt: new Date() } }),
  ]);

  return NextResponse.redirect(`${base}/email-confirmed?status=success`);
}