<?php
// POST { email, password } -> creates an account, signs the user in.
require __DIR__ . '/../lib/bootstrap.php';
require_method('POST');

$body     = json_body();
$email    = strtolower(trim($body['email'] ?? ''));
$password = (string)($body['password'] ?? '');

if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
    json_error('Enter a valid email address.');
}
if (strlen($password) < 8) {
    json_error('Password must be at least 8 characters.');
}

$stmt = db()->prepare('SELECT id FROM users WHERE email = ?');
$stmt->execute([$email]);
if ($stmt->fetch()) {
    json_error('An account with that email already exists.', 409);
}

$hash = password_hash($password, PASSWORD_ARGON2ID);
$stmt = db()->prepare(
    'INSERT INTO users (public_id, email, password_hash) VALUES (?, ?, ?)'
);
$stmt->execute([new_public_id(), $email, $hash]);

issue_session((int)db()->lastInsertId());
json_out(['ok' => true, 'email' => $email]);