CRM_ENVR/src/app/api/auth/recover/route.ts

import { NextRequest, NextResponse } from "next/server"
import {
  getSessionUser,
  decryptPassword,
  setSessionContext,
} from "@/lib/auth"
import { query } from "@/lib/db"

export async function POST(request: NextRequest) {
  try {
    const sessionUser = await getSessionUser()
    if (!sessionUser) {
      return NextResponse.json({ error: "Not authenticated." }, { status: 401 })
    }
    if (sessionUser.role !== "super_admin") {
      return NextResponse.json({ error: "Only SUPER_ADMIN can recover passwords." }, { status: 403 })
    }

    const { userId } = await request.json()
    if (!userId) {
      return NextResponse.json({ error: "userId is required." }, { status: 400 })
    }

    const ipAddress =
      request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ||
      request.headers.get("x-real-ip") ||
      "127.0.0.1"

    await setSessionContext(sessionUser.id, ipAddress)

    const result = await query(
      `SELECT id, username, email, first_name, last_name, password_encrypted
       FROM users WHERE id = $1 AND deleted_at IS NULL`,
      [userId]
    )

    const user = result.rows[0]
    if (!user) {
      return NextResponse.json({ error: "User not found." }, { status: 404 })
    }

    if (!user.password_encrypted) {
      return NextResponse.json({ error: "No encrypted password stored for this user." }, { status: 404 })
    }

    const plaintextPassword = await decryptPassword(user.password_encrypted)
    if (!plaintextPassword) {
      return NextResponse.json({ error: "Failed to decrypt password. Master key may have changed." }, { status: 500 })
    }

    return NextResponse.json({
      user: {
        id: user.id,
        username: user.username,
        email: user.email,
        name: `${user.first_name} ${user.last_name}`,
      },
      password: plaintextPassword,
    }, { status: 200 })
  } catch (error) {
    console.error("Password recovery error:", error)
    return NextResponse.json({ error: "Recovery service unavailable." }, { status: 503 })
  }
}