<?php

declare(strict_types=1);

namespace App\Http\Requests\User;

use App\Models\User;
use Illuminate\Foundation\Http\FormRequest;
use Illuminate\Validation\Rules\Password;

/**
 * A master issuing a new temporary password for another account.
 *
 * This replaces the email-based reset flow that this application deliberately
 * does not have. Whatever password results, the account is flagged
 * `must_change_password`, because the master has necessarily seen it.
 */
class ResetUserPasswordRequest extends FormRequest
{
    public function authorize(): bool
    {
        return $this->user()?->can('resetPassword', $this->targetUser()) ?? false;
    }

    /**
     * @return array<string, array<int, mixed>>
     */
    public function rules(): array
    {
        return [
            // Blank means "generate one", which is the recommended path.
            'password' => ['nullable', 'string', Password::defaults()],
        ];
    }

    public function targetUser(): User
    {
        /** @var User $user */
        $user = $this->route('user');

        return $user;
    }
}
