package API::Command::PostForgotPW;
use strict;
use warnings;

use Data::Dumper;
use Apache2::Const qw(OK FORBIDDEN HTTP_OK HTTP_UNAUTHORIZED HTTP_NOT_IMPLEMENTED);
use CGI::Cookie;

use lib '/app/tools/common/lib';
use Common::Email;
use Common::Util;

use lib '/app/tools/rps/lib';

use lib '/app/tools/appuser/lib';
use AppUser::User::Token;
use AppUser::DB::Item::User;

use lib '/app/tools/api/lib';
use API::Response;
use API::DB::Item::PortalInvite;
use API::DB::Item::PortalPayee;
use API::DB::Item::PasswordRecovery;

use base 'API::Command';

sub area { return "user"; }
sub cmd  { return "forgotpw"; }

use constant kPortalHostname => 'portal.royaltyshare.com';
use constant kPortalURI      => '/password/reset/';

# Send out the forgot password email

sub execute {
    my ($self) = @_;

    my $email = $self->getRouteParam(":email");

    # Check if the portal user exists

    my $userObj = AppUser::DB::Item::User->Lookup(
        'email' => $email,
    );

    if ( defined $userObj && $userObj->user_id ) {
        $self->sendForgotPWEmail($userObj);
    } else {
        Common::Log::Print("API::Command::PostForgotPW: ". HTTP_UNAUTHORIZED . " - Invalid email '$email'");
        return $self->createResponse(
            status => HTTP_UNAUTHORIZED,
            data   => { msg => "Invalid email" }
        );

    }

    return $self->createResponse(
        status => HTTP_OK,
        data   => { msg => "success" }
    );
}

sub sendForgotPWEmail {
    my $self    = shift;
    my $userObj = shift;

    my $email = $userObj->email;

    # Generate and store the token
    #
    my $tokenObj = AppUser::User::Token->new( email => $email );
    my $token    = $tokenObj->GetTimedToken();
    my %args     = (
        user_id => $userObj->user_id,
        email   => $email,
        token   => $token,
    );

    my $recovery = API::DB::Item::PasswordRecovery->Lookup(
        user_id => $userObj->user_id,
        email   => $email
    );
    $recovery->delete() if ($recovery);

    $recovery = API::DB::Item::PasswordRecovery->Create(%args);
    $recovery->save();

    # Build the reset password URL
    #
    my $uri = kPortalURI . $token;

    my $forgotPasswordURL = "https://" . kPortalHostname . $uri;

    my $to      = $email;
    my $from    = 'do-not-reply@royaltyshare.com';
    my $subject = "Reset Password for RoyaltyShare's Payee Portal";

    my $body = "You've requested a link to reset your password for RoyaltyShare's Payee Portal.

Click here to reset your password now:  $forgotPasswordURL

If you did not intend to reset your password, you can ignore this message.

Thanks!

The RoyaltyShare Support Team";

    Common::Email->SendAWS(
        to      => $to,
        from    => $from,
        subject => $subject,
        body    => $body
    );


    return 1;
}

1;