import { IsNotEmpty, IsString, Matches, MaxLength, MinLength } from 'class-validator';

/**
 * Consumes the reset token and sets a new password.
 *
 * Password complexity per governance.md: min 8 chars, at least one
 * letter and one number. Enforced at DTO time so the auth service
 * can trust the input shape.
 */
export class ResetPasswordDto {
  @IsString()
  @IsNotEmpty()
  /** Raw token as delivered in the email link. Hashed at the
   *  service layer before lookup; never persisted. */
  token: string;

  @IsString()
  @IsNotEmpty()
  @MinLength(8, { message: 'Password must be at least 8 characters' })
  @MaxLength(128)
  // At least one letter + one number. Allows symbols + unicode but
  // requires both classes. Per governance.md.
  @Matches(/^(?=.*[A-Za-z])(?=.*\d).+$/, {
    message: 'Password must include at least one letter and one number',
  })
  new_password: string;
}