<?php

namespace App\Http\Controllers\Api\V1\Auth;

use App\Http\Controllers\Api\V1\ApiController;
use App\Http\Requests\Auth\ChangePasswordRequest;
use Illuminate\Http\JsonResponse;
use Illuminate\Support\Facades\Hash;
use Laravel\Sanctum\PersonalAccessToken;

class ChangePasswordController extends ApiController
{
    /**
     * Resident/admin/etc. changes their own password while authenticated.
     * Revokes all OTHER tokens on success — the current token stays so
     * the caller doesn't get logged out mid-request, but every other
     * device/session is dropped.
     */
    public function __invoke(ChangePasswordRequest $request): JsonResponse
    {
        $user = $request->user();
        $user->forceFill(['password' => Hash::make($request->validated('password'))])->save();

        $current = $user->currentAccessToken();
        $currentId = $current instanceof PersonalAccessToken ? $current->id : null;

        PersonalAccessToken::query()
            ->where('tokenable_type', $user->getMorphClass())
            ->where('tokenable_id', $user->id)
            ->when($currentId, fn ($q, $id) => $q->where('id', '!=', $id))
            ->delete();

        return $this->ok([
            'password_changed' => true,
            'other_sessions_revoked' => true,
        ], 'Password changed');
    }
}