#找回密码逻辑：集成 Flask-Mail 发送验证邮件

# app/extensions.py
from flask_mail import Mail

mail = Mail()

# app/__init__.py
def create_app():
    app = Flask(__name__)
    app.config["MAIL_SERVER"] = "smtp.gmail.com"
    app.config["MAIL_PORT"] = 587
    app.config["MAIL_USE_TLS"] = True
    app.config["MAIL_USERNAME"] = os.getenv("MAIL_USERNAME")
    app.config["MAIL_PASSWORD"] = os.getenv("MAIL_PASSWORD")
    app.config["MAIL_DEFAULT_SENDER"] = ("道满博客", os.getenv("MAIL_USERNAME"))

    mail.init_app(app)

from itsdangerous import URLSafeTimedSerializer

class TokenManager:
    def __init__(self, secret_key):
        self.serializer = URLSafeTimedSerializer(secret_key)

    def generate_token(self, email):
        """生成密码重置 Token"""
        return self.serializer.dumps(email, salt="password-reset-salt")

    def verify_token(self, token, expiration=3600):
        """验证 Token（默认 1 小时有效）"""
        try:
            email = self.serializer.loads(
                token,
                salt="password-reset-salt",
                max_age=expiration
            )
            return email
        except Exception:
            return None

token_manager = TokenManager(app.config["SECRET_KEY"])

from flask_mail import Message

@auth_bp.route("/forgot-password", methods=["GET", "POST"])
def forgot_password():
    form = ForgotPasswordForm()
    if form.validate_on_submit():
        user = User.query.filter_by(email=form.email.data).first()

        if user:
            # 生成 Token
            token = token_manager.generate_token(user.email)

            # 构造重置链接
            reset_url = url_for("auth.reset_password", token=token, _external=True)

            # 发送邮件
            msg = Message(
                subject="【道满博客】密码重置请求",
                recipients=[user.email],
                body=f"""
您好，{user.username or user.email}：

我们收到了您对 {user.email} 账户的密码重置请求。

请在 1 小时内点击以下链接重置密码：
{reset_url}

如果这不是您本人的操作，请忽略此邮件，您的账户安全不受影响。

—— 道满博客团队
                """
            )
            mail.send(msg)

        # 无论用户存不存在都显示成功（防止枚举攻击）
        flash("如果该邮箱已注册，我们已发送重置链接到您的邮箱。", "info")
        return redirect(url_for("auth.login"))

    return render_template("auth/forgot_password.html", form=form)

@auth_bp.route("/reset-password/<token>", methods=["GET", "POST"])
def reset_password(token):
    # 验证 Token
    email = token_manager.verify_token(token)
    if not email:
        flash("重置链接已过期或无效，请重新申请。", "danger")
        return redirect(url_for("auth.forgot_password"))

    user = User.query.filter_by(email=email).first()
    if not user:
        flash("用户不存在。", "danger")
        return redirect(url_for("auth.register"))

    form = ResetPasswordForm()
    if form.validate_on_submit():
        user.password = form.password.data  # 自动哈希
        db.session.commit()
        flash("密码已重置，请使用新密码登录！", "success")
        return redirect(url_for("auth.login"))

    return render_template("auth/reset_password.html", form=form, token=token)

# 找回密码四步：

# 1. 生成 Token
token = generate_token(email)

# 2. 发送邮件
msg = Message(subject="...", recipients=[email], body="...")
mail.send(msg)

# 3. 验证 Token
email = verify_token(token)  # 过期返回 None

# 4. 重置密码
user.password = new_password  # 自动哈希
db.session.commit()