defmodule ToweropsWeb.UserResetPasswordControllerTest do
  use ToweropsWeb.ConnCase, async: true

  import Towerops.AccountsFixtures

  # Note: edit/update routes are handled by UserResetPasswordLive, not this controller

  setup do
    %{user: user_fixture(enable_totp: false)}
  end

  describe "GET /users/reset-password" do
    test "renders the reset password page", %{conn: conn} do
      conn = get(conn, ~p"/users/reset-password")
      response = html_response(conn, 200)
      assert response =~ "Forgot your password?"
    end
  end

  describe "POST /users/reset-password" do
    test "sends password reset email for existing user", %{conn: conn, user: user} do
      conn =
        post(conn, ~p"/users/reset-password", %{"user" => %{"email" => user.email}})

      assert redirected_to(conn) == ~p"/users/log-in"
      assert Phoenix.Flash.get(conn.assigns.flash, :info) =~ "If your email is in our system"
    end

    test "does not reveal if email exists (non-existent email)", %{conn: conn} do
      conn =
        post(conn, ~p"/users/reset-password", %{
          "user" => %{"email" => "nobody@example.com"}
        })

      assert redirected_to(conn) == ~p"/users/log-in"
      assert Phoenix.Flash.get(conn.assigns.flash, :info) =~ "If your email is in our system"
    end
  end
end
