import bcrypt from 'bcryptjs';
import { z } from 'zod';
import { db } from '@/lib/db';
import { setSession } from '@/lib/auth';
import { jsonError } from '@/lib/http';
const schema = z.object({ email: z.string().email().max(254), password: z.string().min(1).max(128) });
export async function POST(req: Request) { let body: unknown; try { body = await req.json(); } catch { return jsonError('Format JSON tidak valid.'); } const p = schema.safeParse(body); if (!p.success) return jsonError('Email atau password tidak valid.'); const user = await db.user.findUnique({ where: { email: p.data.email.toLowerCase() } }); if (!user || !(await bcrypt.compare(p.data.password, user.passwordHash))) return jsonError('Email atau password salah.', 401); await setSession(user.id); return Response.json({ user: { id: user.id, email: user.email, displayName: user.displayName, slug: user.slug } }); }