/**
 * 密码重置：验证码校验由调用方先走 verifyCode，本流程只负责更新密码并撤销旧会话。
 */

import { AuthError } from './errors.js'

/**
 * @param {Object} deps
 * @param {import('./index.js').UserRepo} deps.userRepo
 * @param {import('./index.js').Hasher} deps.hasher
 * @returns {(args: { email: string, password: string }) => Promise<{ ok: true }>}
 */
export function makeResetPassword({ userRepo, hasher }) {
  return async function resetPassword({ email, password }) {
    const normalized = String(email ?? '').trim().toLowerCase()
    if (!normalized || !password) {
      throw new AuthError({ code: 'INVALID_CREDENTIALS', message: 'email and password required' })
    }

    const user = await userRepo.findByEmail(normalized)
    if (!user) throw new AuthError({ code: 'USER_NOT_FOUND' })

    const password_hash = await hasher.hash(password)
    await userRepo.updatePasswordHash({ user_id: user.id, password_hash })
    await userRepo.revokeUserSessions({ user_id: user.id })
    return { ok: true }
  }
}