"""Forgot-password flow — email only. There's no SMS/OTP gateway configured,
so even accounts that normally log in by phone get their reset link by email."""

import secrets
from datetime import datetime, timedelta, timezone

from django.urls import reverse

from market.emailer import send_email
from market.site_url import absolute_url

from .supabase_client import get_client

RESET_TOKEN_LIFETIME = timedelta(hours=1)


def request_password_reset(request, email):
    """Always looks like it worked from the outside, whether or not the email
    has an account — so this can't be used to check which emails are registered."""
    client = get_client()
    resp = client.table('pickker_users').select('*').eq('email', email).execute()
    if not resp.data:
        return
    user = resp.data[0]
    token = secrets.token_urlsafe(32)
    client.table('pickker_users').update({
        'password_reset_token': token,
        'password_reset_sent_at': datetime.now(timezone.utc).isoformat(),
    }).eq('id', user['id']).execute()

    reset_url = absolute_url(request, reverse('accounts:reset_password', args=[token]))
    send_email(
        user['email'],
        'Reset your PickkerMarket password',
        f"Hi {user.get('first_name') or ''},\n\n"
        "We received a request to reset your PickkerMarket password. This link is valid for 1 hour:\n"
        f"{reset_url}\n\n"
        "If you didn't request this, you can safely ignore this email — your password won't change.\n\n"
        "— The PickkerMarket Team",
    )


def create_reset_token_for_user(user_id):
    """Same token mechanics as request_password_reset, but for a known
    user_id directly — used for admin-driven invites (e.g. a newly
    registered B2B picker) rather than a self-service "forgot password"
    request. Returns the token so the caller can build its own invite email
    (request_password_reset's forgot-password wording doesn't fit an invite)."""
    token = secrets.token_urlsafe(32)
    get_client().table('pickker_users').update({
        'password_reset_token': token,
        'password_reset_sent_at': datetime.now(timezone.utc).isoformat(),
    }).eq('id', user_id).execute()
    return token


def get_user_for_reset_token(token):
    """Returns the user row if the token is valid and not expired, else None."""
    if not token:
        return None
    client = get_client()
    resp = client.table('pickker_users').select('*').eq('password_reset_token', token).execute()
    if not resp.data:
        return None
    user = resp.data[0]
    sent_at = user.get('password_reset_sent_at')
    if not sent_at:
        return None
    sent_dt = datetime.fromisoformat(sent_at.replace('Z', '+00:00'))
    if datetime.now(timezone.utc) - sent_dt > RESET_TOKEN_LIFETIME:
        return None
    return user


def complete_password_reset(user_id, new_password_hash):
    get_client().table('pickker_users').update({
        'password_hash': new_password_hash,
        'password_reset_token': None,
        'password_reset_sent_at': None,
    }).eq('id', user_id).execute()