<?php

declare(strict_types=1);

namespace App\Notifications;

use Illuminate\Auth\Notifications\ResetPassword;
use Illuminate\Notifications\Messages\MailMessage;

/**
 * Password reset, pointed at the SPA's reset form.
 */
class ResetPasswordNotification extends ResetPassword
{
    public function toMail(mixed $notifiable): MailMessage
    {
        $url = sprintf(
            '%s/reset-password?token=%s&email=%s',
            rtrim((string) config('app.frontend_url'), '/'),
            $this->token,
            urlencode((string) $notifiable->getEmailForPasswordReset()),
        );

        return (new MailMessage)
            ->subject('Reset your Domainsansar password')
            ->greeting('Password reset requested')
            ->line('We received a request to reset the password on your Domainsansar account.')
            ->action('Choose a new password', $url)
            ->line(sprintf(
                'This link expires in %d minutes.',
                (int) config('auth.passwords.users.expire', 60)
            ))
            /*
             * Worth stating plainly: a domain portfolio is a valuable target,
             * and an unexpected reset email is the first signal of an account
             * takeover attempt.
             */
            ->line('If you did not request this, your password has not changed. We recommend reviewing your recent account activity.')
            ->salutation('— The Domainsansar team');
    }
}
