<?php

namespace App\Http\Controllers\Auth;

use App\Http\Controllers\Controller;
use Illuminate\Foundation\Auth\ResetsPasswords;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Password;

class ResetPasswordController extends LoginBaseController
{
    /*
    |--------------------------------------------------------------------------
    | Password Reset Controller
    |--------------------------------------------------------------------------
    |
    | This controller is responsible for handling password reset requests
    | and uses a simple trait to include this behavior. You're free to
    | explore this trait and override any methods you wish to tweak.
    |
    */

    use ResetsPasswords;

    /**
     * Where to redirect users after resetting their password.
     *
     * @var string
     */
    protected $redirectTo = '/login';

    /**
     * Create a new controller instance.
     *
     * @return void
     */
    public function __construct()
    {
        parent::__construct();
        $this->middleware('guest');
    }

    /**
     * Display the password reset view, but only if the token is valid.
     *
     * A token is considered valid when:
     *   - The email exists in the system.
     *   - The token matches the stored hash AND was created within the last 24 hours.
     *   - The token has not been consumed yet (it is deleted on first successful use
     *     by Laravel's built-in reset logic).
     *
     * @param  \Illuminate\Http\Request  $request
     * @param  string  $token
     * @return \Illuminate\View\View|\Illuminate\Http\RedirectResponse
     */
    public function showResetForm(Request $request, $token = null)
    {
        $email = $request->query('email');

        if (!$email) {
            return redirect()->route('login')
                ->withErrors(['email' => 'The reset link is invalid or has expired.']);
        }

        $user = Password::broker()->getUser(['email' => $email]);

        if (!$user || !Password::broker()->tokenExists($user, $token)) {
            return redirect()->route('login')
                ->withErrors(['email' => 'This password reset link is invalid or has already been used.']);
        }

        return view('auth.passwords.reset')->with([
            'token' => $token,
            'email' => $email,
        ]);
    }
}