import { IsEmail, IsNotEmpty, IsOptional, IsUrl, MaxLength } from 'class-validator';

/**
 * Initiates a password reset. The endpoint always returns a generic
 * 200 regardless of whether the email exists (security.md A07 —
 * account-enumeration protection), so this DTO only validates the
 * shape of the input, never reveals whether the user is registered.
 */
export class ForgotPasswordDto {
  @IsEmail()
  @IsNotEmpty()
  email: string;

  /**
   * Frontend origin the user is on (`window.location.origin`), used as
   * the base of the emailed reset link. Only honoured when its hostname
   * is in FRONTEND_ALLOWED_HOSTS.
   */
  @IsOptional()
  @IsUrl({ protocols: ['http', 'https'], require_protocol: true, require_tld: false })
  @MaxLength(255)
  app_url?: string;
}