import { NextResponse } from "next/server";
import { requestPasswordReset } from "../../../lib/customerAuth";
import { checkRateLimit, getClientIp } from "../../../lib/rateLimit";

// Always responds the same way regardless of whether the email exists —
// see requestPasswordReset()'s own comment. Rate-limited a bit tighter
// than login/register (5/15min) since there's no secondary defense here
// the way Payload's own per-account lockout backs up the login route.
export async function POST(request: Request) {
  if (!checkRateLimit(`forgot-password:${getClientIp(request)}`, { limit: 5, windowMs: 15 * 60 * 1000 })) {
    return NextResponse.json({ ok: true });
  }

  const body = await request.json().catch(() => null);
  const email = typeof body?.email === "string" ? body.email : "";
  if (email) await requestPasswordReset(email);

  return NextResponse.json({ ok: true });
}
