package forget

import (
	"context"
	"time"

	"bsm/full/module/base/passport/internal/impl"
	"bsm/full/module/base/passport/internal/models"
	"bsm/full/module/base/passport/internal/vars"
	pb "bsm/full/module/base/passport/pb"
	"git.apinb.com/bsm-sdk/core/errcode"
	"git.apinb.com/bsm-sdk/core/printer"
	"git.apinb.com/bsm-sdk/core/utils"
	"golang.org/x/crypto/bcrypt"
)

// 重罢密码
func Reset(ctx context.Context, in *pb.ForgetResetRequest) (reply *pb.StatusReply, err error) {
	if in.Identity == "" || in.Password == "" {
		return nil, errcode.ErrInvalidArgument
	}

	// 必须先通过 Verify 写入一次性重置票据，否则拒绝改密
	resetKey := vars.ForgetResetTokenPrefix + in.Identity
	if err := impl.RedisService.Client.Get(impl.RedisService.Ctx, resetKey).Err(); err != nil {
		printer.Error("Forget reset token not found by identity %v error:%v", in.Identity, err)
		return nil, errcode.ErrPermissionDenied
	}

	pa, err := models.GetPassportAccountByField("identity", in.Identity)
	if err != nil {
		return nil, err
	}

	if pa.Status == vars.Status_Disable {
		return nil, errcode.ErrPermissionDenied
	}

	salt := utils.UUID()
	hashedPassword, err := bcrypt.GenerateFromPassword([]byte(in.Password+salt), bcrypt.DefaultCost)
	if err != nil {
		return nil, errcode.ErrInternal
	}

	err = impl.DBService.Model(&models.PassportAccount{}).Where("identity = ? ", pa.Identity).Updates(map[string]any{
		"password": string(hashedPassword),
		"salt":     salt,
	}).Error
	if err != nil {
		printer.Error("Update passport account password by identity %+v error:%v", in.Identity, err)
		return nil, errcode.ErrDB
	}

	// 改密成功后删除票据（一次性，防重放）
	if err := impl.RedisService.Client.Del(impl.RedisService.Ctx, resetKey).Err(); err != nil {
		printer.Error("Del forget reset token by identity %v error:%v", in.Identity, err)
	}

	return &pb.StatusReply{
		Message: "OK",
		Timeseq: time.Now().UnixMilli(),
	}, nil
}