export default defineEventHandler(async (event) => {
  if (!passwordAuthEnabled()) {
    throw createError({ statusCode: 404, statusMessage: 'Password login is not enabled' })
  }
  assertLoginAllowed(event)
  const body = await readBody<{ username?: string; password?: string }>(event)
  const username = String(body?.username || '')
  const password = String(body?.password || '')
  const matched = await verifyLocalLogin(username, password)
  if (!matched) {
    recordLoginFailure(event)
    throw createError({ statusCode: 401, statusMessage: 'Incorrect username or password' })
  }
  clearLoginFailures(event)
  setSessionUser(event, { sub: `local:${privateInstanceId()}`, name: matched })
  return { ok: true, user: { name: matched } }
})