Momento/memento-note/app/actions/register.ts

'use server';

import bcrypt from 'bcryptjs';
import prisma from '@/lib/prisma';
import { z } from 'zod';
import { redirect } from 'next/navigation';
import { getSystemConfig } from '@/lib/config';

const RegisterSchema = z.object({
  email: z.string().email(),
  password: z.string().min(6),
  confirmPassword: z.string().min(6),
  name: z.string().min(2),
}).refine((data) => data.password === data.confirmPassword, {
  message: 'Passwords do not match',
  path: ['confirmPassword'],
});

export async function register(prevState: string | undefined, formData: FormData) {
  // Check if registration is allowed
  const config = await getSystemConfig();
  const allowRegister = config.ALLOW_REGISTRATION !== 'false' || process.env.ALLOW_REGISTRATION !== 'false';

  if (!allowRegister) {
    return 'Registration is currently disabled by the administrator.';
  }

  const validatedFields = RegisterSchema.safeParse({
    email: formData.get('email'),
    password: formData.get('password'),
    confirmPassword: formData.get('confirmPassword'),
    name: formData.get('name'),
  });

  if (!validatedFields.success) {
    return 'Invalid fields. Failed to register.';
  }

  const { email, password, name } = validatedFields.data;

  try {
    const existingUser = await prisma.user.findUnique({ where: { email: email.toLowerCase() } });
    if (existingUser) {
      return 'User already exists.';
    }

    const hashedPassword = await bcrypt.hash(password, 10);

    const adminEmail = process.env.ADMIN_EMAIL?.toLowerCase();
    const role = adminEmail && email.toLowerCase() === adminEmail ? 'ADMIN' : 'USER';

    await prisma.user.create({
      data: {
        email: email.toLowerCase(),
        password: hashedPassword,
        name,
        role,
      },
    });
    
    // Attempt to sign in immediately after registration
    // We cannot import signIn here directly if it causes circular deps or issues, 
    // but usually it works. If not, redirecting to login is fine.
    // Let's stick to redirecting to login but with a clear success message?
    // Or better: lowercase the email to fix the potential bug.
  } catch (error) {
    console.error('Registration Error:', error);
    return 'Database Error: Failed to create user.';
  }

  redirect('/login');
}