use axum::extract::State;
use axum_extra::extract::cookie::CookieJar;

use crate::error::AuthError;
use crate::features::AuthService;
use export::auth::reset_password::{ResetPasswordCmd, ResetPasswordResp};
use export::data::{AppRequest, AppRequestData, AppResponseData};

use super::super::cookies;

#[utoipa::path(
    post,
    path = "/auth/password/reset",
    tag = "auth",
    request_body = AppRequestData<ResetPasswordCmd>,
    responses(
        (status = 200, description = "Password updated; all sessions revoked.", body = AppResponseData<ResetPasswordResp>),
        (status = 400, description = "Missing temp_key cookie, weak password, or invalid token.", body = super::super::openapi::ErrorBody),
        (status = 401, description = "Unauthorized.", body = super::super::openapi::ErrorBody),
    ),
)]
pub(crate) async fn handler(
    State(svc): State<AuthService>,
    jar: CookieJar,
    mut cmd: AppRequest<ResetPasswordCmd>,
) -> Result<(CookieJar, AppResponseData<ResetPasswordResp>), AuthError> {
    let cookie_name = crate::features::forgot_password::usecase::cookie_name(
        &svc.config.cookie_name_prefix,
        &cmd.email,
    );

    let value = cookies::read_cookie_value(&jar, &cookie_name)
        .ok_or_else(|| AuthError::BadRequest(format!("missing temp_key cookie {cookie_name}")))?;
    cmd.temp_key_value = value;

    let resp = svc.reset_password(cmd.into_inner()).await?;
    let jar = cookies::remove_cookie(jar, &cookie_name);
    Ok((jar, AppResponseData::ok(resp)))
}