# retoor <retoor@molodetz.nl>

import hashlib
import secrets
import logging
from typing import Annotated
from datetime import datetime, timedelta, timezone
from fastapi import Depends, APIRouter, Request
from fastapi.responses import HTMLResponse
from devplacepy.database import get_table
from devplacepy.utils import generate_uid
from devplacepy.seo import base_seo_context
from devplacepy.models import ForgotPasswordForm
from devplacepy.responses import respond
from devplacepy.schemas import AuthPageOut
from devplacepy.services.audit import record as audit
from devplacepy.dependencies import json_or_form

logger = logging.getLogger(__name__)
router = APIRouter()

@router.get("/forgot-password", response_class=HTMLResponse)
async def forgot_password_page(request: Request):
    seo_ctx = base_seo_context(
        request,
        title="Reset Password",
        robots="noindex,nofollow",
    )
    return respond(
        request,
        "forgot_password.html",
        {**seo_ctx, "request": request, "page": "forgot-password"},
        model=AuthPageOut,
    )

@router.post("/forgot-password")
async def forgot_password(
    request: Request, data: Annotated[ForgotPasswordForm, Depends(json_or_form(ForgotPasswordForm))]
):
    email = data.email.strip().lower()
    seo_ctx = base_seo_context(
        request, title="Reset Password", robots="noindex,nofollow"
    )

    users = get_table("users")
    user = users.find_one(email=email)
    if user:
        token = secrets.token_hex(32)
        token_hash = hashlib.sha256(token.encode()).hexdigest()
        resets = get_table("password_resets")
        resets.insert(
            {
                "uid": generate_uid(),
                "user_uid": user["uid"],
                "token": token_hash,
                "expires_at": (
                    datetime.now(timezone.utc) + timedelta(hours=1)
                ).isoformat(),
                "used": False,
                "created_at": datetime.now(timezone.utc).isoformat(),
            }
        )
        logger.info(f"Password reset requested for {email}")
        audit.record(
            request,
            "auth.password.forgot_request",
            user=None,
            actor_kind="guest",
            target_type="user",
            target_uid=user["uid"],
            target_label=user["username"],
            metadata={"email": email},
            summary=f"password reset requested for {email}",
            links=[audit.target("user", user["uid"], user["username"])],
        )
    else:
        audit.record(
            request,
            "auth.password.forgot_request",
            user=None,
            actor_kind="guest",
            result="failure",
            metadata={"email": email},
            summary=f"password reset requested for unknown email {email}",
        )

    return respond(
        request,
        "forgot_password.html",
        {
            **seo_ctx,
            "request": request,
            "sent": True,
        },
        model=AuthPageOut,
    )
