const form = document.querySelector("#reset-form");
const message = document.querySelector("#message");
const resetToken = new URLSearchParams(location.search).get("token") || "";

function showError(text) {
	message.textContent = text;
	message.className = "auth-message error";
}

if (!resetToken) {
	form.classList.add("hidden");
	showError(
		"This reset link is missing its token. Request a new one from the forgot-password page.",
	);
}

form.addEventListener("submit", async (event) => {
	event.preventDefault();
	const data = Object.fromEntries(new FormData(form));
	if (data.password !== data.confirmPassword) {
		showError("Passwords do not match.");
		return;
	}
	const submitButton = form.querySelector("button[type=submit]");
	submitButton.disabled = true;
	message.textContent = "";
	try {
		const response = await fetch("/api/auth/reset", {
			method: "POST",
			headers: { "content-type": "application/json" },
			body: JSON.stringify({ token: resetToken, password: data.password }),
		});
		const body = await response.json();
		if (!response.ok) {
			showError(
				{
					invalid_token:
						"This reset link is invalid or has expired. Request a new one.",
					account_disabled:
						"Your password was updated, but this account is disabled. Contact an administrator.",
				}[body.code] || body.error || "Could not reset the password.",
			);
			return;
		}
		location.assign("/app");
	} catch {
		showError("Could not reach the server. Check your connection and try again.");
	} finally {
		submitButton.disabled = false;
	}
});