#!/usr/bin/env bash
# 偶合 OppHub · 改密码
set -e

OPPHUB_HOME="${OPPHUB_HOME:-$HOME/.opphub}"
API_BASE="${OPPHUB_API_BASE:-https://api.opphub.ruiplus.cn}"

GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
RED='\033[0;31m'
NC='\033[0m'

step() { echo -e "${BLUE}━━━ $1 ━━━${NC}"; }
ok()   { echo -e "${GREEN}✓ $1${NC}"; }
warn() { echo -e "${YELLOW}⚠ $1${NC}"; }
fail() { echo -e "${RED}✗ $1${NC}"; exit 1; }

STATE="$OPPHUB_HOME/state.json"
[ ! -f "$STATE" ] && fail "未登录"

TOKEN=$(grep -o '"opphub_token":"[^"]*"' "$STATE" | cut -d'"' -f4)
TARGET=$(grep -o '"target":"[^"]*"' "$STATE" | cut -d'"' -f4)
TYPE=$(grep -o '"type":"[^"]*"' "$STATE" | cut -d'"' -f4)

step "改密码"

# 发验证码
RESP=$(curl -s -X POST "$API_BASE/v1/auth/code/send" \
  -H "Content-Type: application/json" \
  -d "{\"type\":\"$TYPE\",\"target\":\"$TARGET\",\"purpose\":\"passwd\"}")

if ! echo "$RESP" | grep -q '"ok":true'; then
  fail "验证码发送失败"
fi

ok "验证码已发送到 $TARGET"
read -p "请输入验证码: " CODE
read -s -p "新密码（8-20 位，含大小写+数字）: " PASSWORD
echo ""
read -s -p "确认密码: " PASSWORD2
echo ""

if [ "$PASSWORD" != "$PASSWORD2" ]; then
  fail "两次密码不一致"
fi

# 校验强度
if [ ${#PASSWORD} -lt 8 ] || [ ${#PASSWORD} -gt 20 ]; then
  fail "密码长度 8-20 位"
fi
if ! echo "$PASSWORD" | grep -q '[A-Z]' || ! echo "$PASSWORD" | grep -q '[a-z]' || ! echo "$PASSWORD" | grep -q '[0-9]'; then
  fail "密码必须含大小写字母 + 数字"
fi

# 改
RESP=$(curl -s -X POST "$API_BASE/v1/auth/passwd" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d "{\"code\":\"$CODE\",\"newPassword\":\"$PASSWORD\"}")

if echo "$RESP" | grep -q '"ok":true'; then
  ok "密码已更新"
else
  fail "改失败：$(echo "$RESP" | grep -o '"error":"[^"]*"' | head -1)"
fi
