import { ApiProperty, ApiPropertyOptional } from "@nestjs/swagger";
import { IsEnum, IsNotEmpty, IsOptional, IsString, IsUUID } from "class-validator";

/**
 * The channel a reset LINK is delivered over. The OTP flow no longer picks one —
 * it sends to every contact on the account — but the staff-triggered link flow
 * still delivers over exactly one transport.
 */
export enum ResetChannel {
  Email = "email",
  Phone = "phone",
}

export class ForgotPasswordRequestDto {
  @ApiProperty({
    description: "Email, username, or phone number of the account to reset",
    example: "name@company.com",
  })
  @IsString()
  @IsNotEmpty()
  identifier!: string;

  /**
   * Accepted and ignored. The code now goes to the account's email AND phone,
   * so there is nothing to choose — kept optional so clients still sending it
   * (older portal/backoffice builds) are not rejected outright.
   * @deprecated
   */
  @ApiPropertyOptional({
    enum: ResetChannel,
    deprecated: true,
    description: "Ignored — the code is sent to every contact on the account.",
  })
  @IsOptional()
  @IsEnum(ResetChannel)
  channel?: ResetChannel;
}

export class ForgotPasswordVerifyDto extends ForgotPasswordRequestDto {
  @ApiProperty({
    description:
      "The 6-digit code sent to the account's email and phone. Either delivery carries the same code.",
  })
  @IsString()
  @IsNotEmpty()
  otp!: string;
}

export class BackofficeResetPasswordDto {
  @ApiProperty({ enum: ResetChannel })
  @IsEnum(ResetChannel)
  channel!: ResetChannel;
}

/**
 * The two halves of a reset link's query string. Together they stand in for the
 * identifier + OTP pair of the typed flow: the token proves possession of the
 * inbox/handset the link was delivered to.
 */
export class ResolveResetLinkDto {
  @ApiProperty({ description: "IAM user id from the reset link's `uid` param" })
  @IsUUID()
  userId!: string;

  @ApiProperty({ description: "Opaque token from the reset link's `token` param" })
  @IsString()
  @IsNotEmpty()
  token!: string;
}
