tessera-ctl/apps/web/src/app/(auth)/reset-password/page.tsx

'use client';

import { useState, useTransition } from 'react';
import { useTranslations } from 'next-intl';
import Link from 'next/link';
import { TesseraLogo } from '@/components/brand/tessera-logo';

const API_URL = process.env.NEXT_PUBLIC_API_URL || 'http://localhost:3001';

/**
 * Password reset request page (D-03 self-service).
 * Simple form with email input. Always shows success message
 * regardless of whether email exists (T-02-12: prevent enumeration).
 * Part of (auth) route group -- no sidebar/header (D-04).
 */
export default function ResetPasswordPage() {
  const t = useTranslations('auth');
  const [isPending, startTransition] = useTransition();
  const [submitted, setSubmitted] = useState(false);
  const [error, setError] = useState<string | null>(null);

  async function handleSubmit(e: React.FormEvent<HTMLFormElement>) {
    e.preventDefault();
    setError(null);

    const formData = new FormData(e.currentTarget);
    const email = formData.get('email') as string;

    if (!email) return;

    startTransition(async () => {
      try {
        const response = await fetch(`${API_URL}/auth/request-reset`, {
          method: 'POST',
          headers: { 'Content-Type': 'application/json' },
          body: JSON.stringify({ email }),
        });

        if (!response.ok) {
          setError('networkError');
          return;
        }

        setSubmitted(true);
      } catch {
        setError('networkError');
      }
    });
  }

  return (
    <div className="flex min-h-screen items-center justify-center bg-background px-4 py-8">
      <div className="w-full max-w-sm space-y-8">
        {/* Heading */}
        <div className="text-center">
          <TesseraLogo variant="horizontal" size={32} />
          <h2 className="mt-4 text-2xl font-semibold text-foreground">
            {t('resetPassword.title')}
          </h2>
        </div>

        {submitted ? (
          /* Success message -- always shown, prevents email enumeration */
          <div className="space-y-4">
            <div className="rounded-md bg-green-50 dark:bg-green-900/20 border border-green-200 dark:border-green-800 px-4 py-3 text-sm text-green-800 dark:text-green-200">
              {t('resetPassword.success')}
            </div>
            <Link
              href="/login"
              className="btn btn-primary w-full"
            >
              {t('resetPassword.backToLogin')}
            </Link>
          </div>
        ) : (
          /* Email form */
          <>
            {/* Error message */}
            {error && (
              <div className="rounded-md bg-destructive/10 border border-destructive/20 px-4 py-3 text-sm text-destructive">
                {t(`error.${error}`)}
              </div>
            )}

            <form onSubmit={handleSubmit} className="space-y-5">
              <div className="space-y-2">
                <label
                  htmlFor="email"
                  className="text-sm font-medium text-foreground"
                >
                  {t('resetPassword.email')}
                </label>
                <input
                  id="email"
                  name="email"
                  type="email"
                  required
                  autoComplete="email"
                  className="flex h-10 w-full rounded-md border border-input bg-background px-3 py-2 text-sm ring-offset-background placeholder:text-muted-foreground focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2"
                  placeholder={t('resetPassword.email')}
                />
              </div>

              <button
                type="submit"
                disabled={isPending}
                className="btn btn-primary w-full"
              >
                {isPending ? (
                  <svg
                    className="animate-spin h-4 w-4"
                    aria-hidden="true"
                    xmlns="http://www.w3.org/2000/svg"
                    fill="none"
                    viewBox="0 0 24 24"
                  >
                    <circle
                      className="opacity-25"
                      cx="12"
                      cy="12"
                      r="10"
                      stroke="currentColor"
                      strokeWidth="4"
                    />
                    <path
                      className="opacity-75"
                      fill="currentColor"
                      d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4z"
                    />
                  </svg>
                ) : (
                  t('resetPassword.submit')
                )}
              </button>
            </form>

            <div className="text-center">
              <Link
                href="/login"
                className="text-sm text-muted-foreground hover:text-foreground transition-colors"
              >
                {t('resetPassword.backToLogin')}
              </Link>
            </div>
          </>
        )}
      </div>
    </div>
  );
}