'use strict';
// routes/passwordReset.js — "Forgot password" request queue (see
// services/passwordResetStore.js for why this is a request queue rather
// than an email-based reset flow).
const express = require('express');
const router  = express.Router();
const { verifyToken, verifyUserAdmin } = require('../middleware/auth');

const store = () => require('../services/passwordResetStore');

// Submit a request — public, no auth (the whole point is the user is locked out)
router.post('/', async (req, res) => {
  try {
    const username = (req.body?.username || '').trim();
    const note = (req.body?.note || '').trim();
    if (!username) return res.status(400).json({ success: false, message: 'Username is required' });
    if (username.length > 50) return res.status(400).json({ success: false, message: 'Username too long' });
    if (note.length > 500) return res.status(400).json({ success: false, message: 'Note too long' });
    await store().createRequest(username, note);
    res.json({ success: true, message: 'Request submitted — an admin will reset your password shortly.' });
  } catch (err) { res.status(500).json({ success: false, message: err.message }); }
});

// List requests — admin only
router.get('/', verifyToken, verifyUserAdmin, async (req, res) => {
  try {
    const data = await store().listRequests(req.query.status || null);
    res.json({ success: true, data });
  } catch (err) { res.status(500).json({ success: false, message: err.message }); }
});

// Mark a request resolved/dismissed — admin only
router.post('/:id/resolve', verifyToken, verifyUserAdmin, async (req, res) => {
  try {
    const status = req.body?.status === 'DISMISSED' ? 'DISMISSED' : 'RESOLVED';
    await store().resolveRequest(req.params.id, status, req.user.username);
    res.json({ success: true });
  } catch (err) { res.status(500).json({ success: false, message: err.message }); }
});

module.exports = router;