package console

import (
	"context"
	"fmt"
	"strings"

	"git.golem15.com/golem15/sm-user-plugin/classes"
	"git.golem15.com/golem15/sm-user-plugin/models"
	"git.golem15.com/golem15/summercms/modules/backpack"
	"git.golem15.com/golem15/summercms/modules/bonfire"
	"gorm.io/gorm"
)

// RequirePasswordChange forces the named account to set a new password on next login.
func RequirePasswordChange(app *backpack.App) bonfire.Command {
	return bonfire.Command{
		Name:        "user:require-password-change",
		Description: "Force a user to change their password on next login (D-21)",
		Args: []bonfire.Arg{{
			Name:        "email",
			Description: "Account email",
			Required:    true,
		}},
		Run: func(ctx context.Context, in bonfire.Input, out bonfire.Output) error {
			email, ok := in.Argument("email")
			email = strings.TrimSpace(email)
			if !ok || email == "" {
				return fmt.Errorf("email is required")
			}
			if app == nil {
				return fmt.Errorf("user:require-password-change: app is nil")
			}
			gdb, ok := app.Lookup[*gorm.DB]()
			if !ok || gdb == nil {
				return fmt.Errorf("user:require-password-change: database is not configured")
			}
			user, err := classes.LookupByEmail(ctx, gdb, email)
			if err != nil {
				return err
			}
			if user == nil {
				return fmt.Errorf("user %s not found", email)
			}
			res := gdb.WithContext(ctx).Model(&models.User{}).Where("id = ?", user.ID).Update("must_change_password", true)
			if res.Error != nil {
				return res.Error
			}
			if res.RowsAffected != 1 {
				return fmt.Errorf("user %s was not updated", email)
			}
			out.Success("Password change required for " + user.Email)
			return nil
		},
	}
}