/* Public auth endpoints. All are unauthenticated (`auth: false`) — attaching a
   stale bearer to a login request would be harmless but misleading in the
   network log, and the reset flow must never trigger a refresh. */
import { request } from '../lib/apiClient'

const pub = { auth: false }

export function login(email, password) {
  return request('/users/login', { ...pub, method: 'POST', body: { email, password } })
}

export function signup(name, email, password) {
  return request('/users/signup', { ...pub, method: 'POST', body: { name, email, password } })
}

export function confirmEmail(token) {
  return request('/users/confirm-email', { ...pub, method: 'POST', body: { token } })
}

export function resendConfirmEmail(email) {
  return request('/users/confirm-email/resend', { ...pub, method: 'POST', body: { email } })
}

export function forgetPassword(email) {
  return request('/users/forget-password', { ...pub, method: 'POST', body: { email } })
}

export function verifyForgetCode(email, code) {
  return request('/users/forget-password/verify-code', {
    ...pub,
    method: 'POST',
    body: { email, code },
  })
}

export function setNewPassword(password, resetToken) {
  // `token` is the 10-minute reset JWT, carried in its own Authorization header
  // and checked by forget_password/permissions.py's HTTPBearer. Passing `token`
  // explicitly also suppresses the refresh path, which is what we want: a reset
  // token is not a session.
  return request('/users/forget-password/new-password', {
    method: 'POST',
    body: { password },
    token: resetToken,
  })
}