<?php
require __DIR__ . '/_bootstrap.php';
require __DIR__ . '/_codes.php';
require __DIR__ . '/_mail.php';

/**
 * @OA\Post(
 *   path="/password-forgot.php",
 *   tags={"Auth"},
 *   summary="Send a password reset code",
 *   description="Always answers 200, even for an unknown e-mail, so the endpoint cannot be used to enumerate accounts.",
 *   security={},
 *   @OA\RequestBody(required=true, @OA\JsonContent(
 *     required={"email"},
 *     @OA\Property(property="email", type="string", format="email")
 *   )),
 *   @OA\Response(response=200, ref="#/components/responses/Success")
 * )
 */
require_method('POST');

$email = trim((string) (body()['email'] ?? ''));

if ($email !== '') {
    $stmt = $pdo->prepare('SELECT id FROM auth_users WHERE email = ? LIMIT 1');
    $stmt->execute([$email]);
    if ($stmt->fetchColumn() && $code = issue_code($pdo, 'auth_password_resets', $email)) {
        send_code_mail($email, $code, true);
    }
}

json_ok();