use crate::api::context;
use crate::api::envelope::Envelope;
use crate::auth;
use crate::error::{AppError, ErrorCode};
use crate::services::{credentials, mail, rate_limit, settings};
use crate::state::AppState;

use axum::{
    extract::{ConnectInfo, State},
    http::HeaderMap,
    routing::post,
    Json, Router,
};
use chrono::{DateTime, Duration, Utc};
use serde::{Deserialize, Serialize};
use std::net::SocketAddr;
use uuid::Uuid;

pub fn router() -> Router<AppState> {
    Router::new()
        .route("/register", post(register))
        .route("/login", post(login))
        .route("/send-verification", post(send_verification))
        .route("/verify-email", post(verify_email))
        .route("/forgot-password", post(forgot_password))
        .route("/reset-password", post(reset_password))
}

#[derive(Debug, Deserialize)]
struct RegisterRequest {
    email: String,
    password: String,
    username: String,
}

#[derive(Debug, Serialize)]
struct RegisterResponse {
    user: UserView,
    token: String,
    message: String,
}

#[derive(Debug, Deserialize)]
struct LoginRequest {
    email: String,
    password: String,
}

#[derive(Debug, Serialize)]
struct LoginResponse {
    token: String,
    expires_at: DateTime<Utc>,
    user: UserView,
}

#[derive(Debug, Serialize)]
struct UserView {
    id: Uuid,
    email: String,
    username: String,
    role: String,
    email_verified: bool,
}

#[derive(Debug, sqlx::FromRow)]
struct UserRow {
    id: Uuid,
    email: String,
    username: String,
    password_hash: String,
    role: String,
    is_active: bool,
    email_verified_at: Option<DateTime<Utc>>,
    token_version: i32,
}

async fn register(
    State(state): State<AppState>,
    ConnectInfo(addr): ConnectInfo<SocketAddr>,
    headers: HeaderMap,
    Json(req): Json<RegisterRequest>,
) -> Result<Json<Envelope<RegisterResponse>>, AppError> {
    let ip = context::client_ip(&headers, addr.ip());
    let policy = settings::runtime_policy(&state).await?;
    if !policy.features.registration_enabled {
        return Err(AppError::new(
            ErrorCode::Forbidden,
            "用户注册功能当前已关闭",
        ));
    }
    rate_limit::enforce(
        &state,
        "auth_register_ip",
        &ip.to_string(),
        policy.rate_limits.register_ip_per_hour,
        60 * 60,
        "注册请求过于频繁，请稍后再试",
    )
    .await?;

    credentials::validate_email(&req.email)?;
    credentials::validate_username(&req.username)?;
    credentials::validate_password(&req.password)?;

    let password_hash = credentials::hash_password(&req.password).await?;
    let verification_required = policy.auth.email_verification_required;
    let verified_at = (!verification_required).then(Utc::now);

    let user = sqlx::query_as::<_, UserRow>(
        r#"
        INSERT INTO users (email, username, password_hash, email_verified_at)
        VALUES ($1, $2, $3, $4)
        RETURNING
          id,
          email,
          username,
          password_hash,
          role::text AS role,
          is_active,
          email_verified_at,
          token_version
        "#,
    )
    .bind(req.email.to_lowercase())
    .bind(&req.username)
    .bind(password_hash)
    .bind(verified_at)
    .fetch_one(&state.db)
    .await
    .map_err(map_unique_violation)?;

    let (token, _expires_at) = auth::issue_jwt(
        &state.config.jwt_secret,
        state.config.jwt_expiry_hours,
        user.id,
        &user.role,
        user.token_version,
    )?;

    if verification_required {
        let verification_token = credentials::generate_token();
        let token_hash = credentials::sha256_hex(&verification_token);
        let expires_at_db = Utc::now() + Duration::hours(24);

        sqlx::query(
            r#"
            INSERT INTO email_verifications (user_id, token_hash, expires_at)
            VALUES ($1, $2, $3)
            "#,
        )
        .bind(user.id)
        .bind(token_hash)
        .bind(expires_at_db)
        .execute(&state.db)
        .await
        .map_err(|err| {
            AppError::new(ErrorCode::Internal, "创建邮箱验证记录失败").with_source(err)
        })?;

        let verification_url = format!(
            "{}/verify-email?token={}",
            state.config.public_base_url, verification_token
        );

        mail::send_verification_email(&state, &user.email, &user.username, &verification_url)
            .await
            .map_err(|err| {
                AppError::new(ErrorCode::MailSendFailed, "验证邮件发送失败").with_source(err)
            })?;
    }

    let body = RegisterResponse {
        user: UserView {
            id: user.id,
            email: user.email,
            username: user.username,
            role: user.role,
            email_verified: user.email_verified_at.is_some(),
        },
        token,
        message: if verification_required {
            "注册成功，验证邮件已发送至您的邮箱".to_string()
        } else {
            "注册成功".to_string()
        },
    };

    Ok(Json(Envelope {
        success: true,
        data: body,
    }))
}

async fn login(
    State(state): State<AppState>,
    ConnectInfo(addr): ConnectInfo<SocketAddr>,
    headers: HeaderMap,
    Json(req): Json<LoginRequest>,
) -> Result<Json<Envelope<LoginResponse>>, AppError> {
    let identity = req.email.trim();
    if identity.is_empty() {
        return Err(AppError::new(
            ErrorCode::InvalidRequest,
            "邮箱或用户名不能为空",
        ));
    }

    let ip = context::client_ip(&headers, addr.ip());
    let policy = settings::runtime_policy(&state).await?;
    rate_limit::enforce(
        &state,
        "auth_login_ip",
        &ip.to_string(),
        policy.rate_limits.login_ip_per_5_minutes,
        5 * 60,
        "登录请求过于频繁，请稍后再试",
    )
    .await?;
    rate_limit::enforce(
        &state,
        "auth_login_identity",
        &identity.to_lowercase(),
        policy.rate_limits.login_identity_per_5_minutes,
        5 * 60,
        "该账号登录尝试过于频繁，请稍后再试",
    )
    .await?;

    let user = if identity.contains('@') {
        credentials::validate_email(identity)?;
        sqlx::query_as::<_, UserRow>(
            r#"
            SELECT
              id,
              email,
              username,
              password_hash,
              role::text AS role,
              is_active,
              email_verified_at,
              token_version
            FROM users
            WHERE email = $1
            "#,
        )
        .bind(identity.to_lowercase())
        .fetch_optional(&state.db)
        .await
    } else {
        credentials::validate_username(identity)?;
        sqlx::query_as::<_, UserRow>(
            r#"
            SELECT
              id,
              email,
              username,
              password_hash,
              role::text AS role,
              is_active,
              email_verified_at,
              token_version
            FROM users
            WHERE username = $1
            "#,
        )
        .bind(identity)
        .fetch_optional(&state.db)
        .await
    }
    .map_err(|err| AppError::new(ErrorCode::Internal, "查询用户失败").with_source(err))?;

    let Some(user) = user else {
        credentials::consume_dummy_password_work(&req.password).await?;
        return Err(AppError::new(ErrorCode::Unauthorized, "账号或密码错误"));
    };

    if !credentials::verify_password(&req.password, &user.password_hash).await? {
        return Err(AppError::new(ErrorCode::Unauthorized, "账号或密码错误"));
    }
    if !user.is_active {
        return Err(AppError::new(ErrorCode::Forbidden, "账号已被禁用"));
    }
    let verification_required = policy.auth.email_verification_required;

    let (token, expires_at) = auth::issue_jwt(
        &state.config.jwt_secret,
        state.config.jwt_expiry_hours,
        user.id,
        &user.role,
        user.token_version,
    )?;

    Ok(Json(Envelope {
        success: true,
        data: LoginResponse {
            token,
            expires_at,
            user: UserView {
                id: user.id,
                email: user.email,
                username: user.username,
                role: user.role,
                email_verified: user.email_verified_at.is_some() || !verification_required,
            },
        },
    }))
}

#[derive(Debug, Serialize)]
struct MessageResponse {
    message: String,
}

async fn send_verification(
    State(state): State<AppState>,
    headers: HeaderMap,
) -> Result<Json<Envelope<MessageResponse>>, AppError> {
    let claims = auth::require_jwt(&state.config.jwt_secret, &headers)?;
    let policy = settings::runtime_policy(&state).await?;

    if !policy.auth.email_verification_required {
        return Ok(Json(Envelope {
            success: true,
            data: MessageResponse {
                message: "邮箱验证功能当前已关闭，无需验证".to_string(),
            },
        }));
    }

    rate_limit::enforce(
        &state,
        "auth_send_verification_user",
        &claims.sub.to_string(),
        policy.rate_limits.verification_email_per_minute,
        60,
        "发送过于频繁，请稍后再试",
    )
    .await?;

    let user = sqlx::query_as::<_, UserRow>(
        r#"
        SELECT
          id,
          email,
          username,
          password_hash,
          role::text AS role,
          is_active,
          email_verified_at,
          token_version
        FROM users
        WHERE id = $1
        "#,
    )
    .bind(claims.sub)
    .fetch_optional(&state.db)
    .await
    .map_err(|err| AppError::new(ErrorCode::Internal, "查询用户失败").with_source(err))?
    .ok_or_else(|| AppError::new(ErrorCode::Unauthorized, "用户不存在或未登录"))?;

    if claims.ver != user.token_version {
        return Err(AppError::new(
            ErrorCode::Unauthorized,
            "登录状态已失效，请重新登录",
        ));
    }

    if user.email_verified_at.is_some() {
        return Ok(Json(Envelope {
            success: true,
            data: MessageResponse {
                message: "邮箱已验证，无需重复验证".to_string(),
            },
        }));
    }

    let verification_token = credentials::generate_token();
    let token_hash = credentials::sha256_hex(&verification_token);
    let expires_at_db = Utc::now() + Duration::hours(24);

    sqlx::query(
        r#"
        INSERT INTO email_verifications (user_id, token_hash, expires_at)
        VALUES ($1, $2, $3)
        "#,
    )
    .bind(user.id)
    .bind(token_hash)
    .bind(expires_at_db)
    .execute(&state.db)
    .await
    .map_err(|err| AppError::new(ErrorCode::Internal, "创建邮箱验证记录失败").with_source(err))?;

    let verification_url = format!(
        "{}/verify-email?token={}",
        state.config.public_base_url, verification_token
    );

    mail::send_verification_email(&state, &user.email, &user.username, &verification_url)
        .await
        .map_err(|err| {
            AppError::new(ErrorCode::MailSendFailed, "验证邮件发送失败").with_source(err)
        })?;

    Ok(Json(Envelope {
        success: true,
        data: MessageResponse {
            message: "验证邮件已发送，请查收".to_string(),
        },
    }))
}

#[derive(Debug, Deserialize)]
struct VerifyEmailRequest {
    token: String,
}

#[derive(Debug, Serialize)]
struct VerifyEmailResponse {
    message: String,
    session_invalidated: bool,
}

struct EmailChangeConfirmation {
    old_email: String,
}

async fn verify_email(
    State(state): State<AppState>,
    ConnectInfo(addr): ConnectInfo<SocketAddr>,
    headers: HeaderMap,
    Json(req): Json<VerifyEmailRequest>,
) -> Result<Json<Envelope<VerifyEmailResponse>>, AppError> {
    if req.token.trim().is_empty() {
        return Err(AppError::new(ErrorCode::InvalidRequest, "token 不能为空"));
    }

    let ip = context::client_ip(&headers, addr.ip());
    let policy = settings::runtime_policy(&state).await?;
    rate_limit::enforce(
        &state,
        "auth_verify_email_ip",
        &ip.to_string(),
        policy.rate_limits.email_verify_ip_per_15_minutes,
        15 * 60,
        "验证请求过于频繁，请稍后再试",
    )
    .await?;

    let token_hash = credentials::sha256_hex(&req.token);
    let now = Utc::now();

    if let Some(confirmation) = confirm_email_change(&state, &token_hash, now).await? {
        if let Err(err) = mail::send_email_change_notice(&state, &confirmation.old_email).await {
            tracing::warn!(error = ?err, "email change notice delivery failed");
        }
        return Ok(Json(Envelope {
            success: true,
            data: VerifyEmailResponse {
                message: "新邮箱确认成功，请重新登录".to_string(),
                session_invalidated: true,
            },
        }));
    }

    let updated = sqlx::query(
        r#"
        WITH v AS (
          SELECT user_id
          FROM email_verifications
          WHERE token_hash = $1
            AND verified_at IS NULL
            AND expires_at > $2
          LIMIT 1
        ),
        u AS (
          UPDATE users
          SET email_verified_at = $2
          WHERE id = (SELECT user_id FROM v)
            AND email_verified_at IS NULL
          RETURNING id
        )
        UPDATE email_verifications
        SET verified_at = $2
        WHERE token_hash = $1
          AND verified_at IS NULL
          AND expires_at > $2
          AND user_id IN (SELECT id FROM u)
        "#,
    )
    .bind(token_hash)
    .bind(now)
    .execute(&state.db)
    .await
    .map_err(|err| AppError::new(ErrorCode::Internal, "邮箱验证失败").with_source(err))?;

    if updated.rows_affected() == 0 {
        return Err(AppError::new(ErrorCode::InvalidToken, "Token 无效或已过期"));
    }

    Ok(Json(Envelope {
        success: true,
        data: VerifyEmailResponse {
            message: "邮箱验证成功".to_string(),
            session_invalidated: false,
        },
    }))
}

async fn confirm_email_change(
    state: &AppState,
    token_hash: &str,
    now: DateTime<Utc>,
) -> Result<Option<EmailChangeConfirmation>, AppError> {
    let user_id: Option<Uuid> = sqlx::query_scalar(
        r#"
        SELECT user_id
        FROM email_change_requests
        WHERE token_hash = $1
          AND confirmed_at IS NULL
          AND canceled_at IS NULL
          AND expires_at > $2
        "#,
    )
    .bind(token_hash)
    .bind(now)
    .fetch_optional(&state.db)
    .await
    .map_err(|err| AppError::new(ErrorCode::Internal, "查询邮箱变更请求失败").with_source(err))?;
    let Some(user_id) = user_id else {
        return Ok(None);
    };

    let mut tx = state
        .db
        .begin()
        .await
        .map_err(|err| AppError::new(ErrorCode::Internal, "开启事务失败").with_source(err))?;
    let user: Option<(String,)> =
        sqlx::query_as("SELECT email FROM users WHERE id = $1 FOR UPDATE")
            .bind(user_id)
            .fetch_optional(&mut *tx)
            .await
            .map_err(|err| AppError::new(ErrorCode::Internal, "锁定用户失败").with_source(err))?;
    let Some((old_email,)) = user else {
        tx.rollback().await.ok();
        return Ok(None);
    };

    let request: Option<(Uuid, String)> = sqlx::query_as(
        r#"
        SELECT id, new_email
        FROM email_change_requests
        WHERE token_hash = $1
          AND user_id = $2
          AND confirmed_at IS NULL
          AND canceled_at IS NULL
          AND expires_at > $3
        FOR UPDATE
        "#,
    )
    .bind(token_hash)
    .bind(user_id)
    .bind(now)
    .fetch_optional(&mut *tx)
    .await
    .map_err(|err| AppError::new(ErrorCode::Internal, "锁定邮箱变更请求失败").with_source(err))?;
    let Some((request_id, new_email)) = request else {
        tx.rollback().await.ok();
        return Ok(None);
    };

    let changed = sqlx::query(
        r#"
        UPDATE users u
        SET email = $2,
            email_verified_at = $3,
            token_version = token_version + 1,
            updated_at = NOW()
        WHERE u.id = $1
          AND NOT EXISTS (
            SELECT 1 FROM users other
            WHERE other.email = $2 AND other.id <> u.id
          )
        "#,
    )
    .bind(user_id)
    .bind(&new_email)
    .bind(now)
    .execute(&mut *tx)
    .await
    .map_err(|err| {
        if matches!(&err, sqlx::Error::Database(db) if db.code().as_deref() == Some("23505")) {
            AppError::new(ErrorCode::InvalidRequest, "新邮箱已被其他账号使用")
        } else {
            AppError::new(ErrorCode::Internal, "确认新邮箱失败").with_source(err)
        }
    })?;
    if changed.rows_affected() == 0 {
        return Err(AppError::new(
            ErrorCode::InvalidRequest,
            "新邮箱已被其他账号使用",
        ));
    }

    sqlx::query(
        "UPDATE email_change_requests SET confirmed_at = $2 WHERE id = $1 AND confirmed_at IS NULL AND canceled_at IS NULL",
    )
    .bind(request_id)
    .bind(now)
    .execute(&mut *tx)
    .await
    .map_err(|err| AppError::new(ErrorCode::Internal, "完成邮箱变更请求失败").with_source(err))?;
    sqlx::query(
        "UPDATE email_change_requests SET canceled_at = $2 WHERE user_id = $1 AND id <> $3 AND confirmed_at IS NULL AND canceled_at IS NULL",
    )
    .bind(user_id)
    .bind(now)
    .bind(request_id)
    .execute(&mut *tx)
    .await
    .map_err(|err| AppError::new(ErrorCode::Internal, "撤销旧邮箱变更请求失败").with_source(err))?;
    sqlx::query("UPDATE password_resets SET used_at = $2 WHERE user_id = $1 AND used_at IS NULL")
        .bind(user_id)
        .bind(now)
        .execute(&mut *tx)
        .await
        .map_err(|err| {
            AppError::new(ErrorCode::Internal, "撤销密码重置请求失败").with_source(err)
        })?;
    sqlx::query(
        "UPDATE email_verifications SET verified_at = $2 WHERE user_id = $1 AND verified_at IS NULL",
    )
    .bind(user_id)
    .bind(now)
    .execute(&mut *tx)
    .await
    .map_err(|err| AppError::new(ErrorCode::Internal, "撤销旧邮箱验证请求失败").with_source(err))?;

    tx.commit()
        .await
        .map_err(|err| AppError::new(ErrorCode::Internal, "提交邮箱变更失败").with_source(err))?;
    Ok(Some(EmailChangeConfirmation { old_email }))
}

#[derive(Debug, Deserialize)]
struct ForgotPasswordRequest {
    email: String,
}

async fn forgot_password(
    State(state): State<AppState>,
    ConnectInfo(addr): ConnectInfo<SocketAddr>,
    headers: HeaderMap,
    Json(req): Json<ForgotPasswordRequest>,
) -> Result<Json<Envelope<MessageResponse>>, AppError> {
    credentials::validate_email(&req.email)?;

    let ip = context::client_ip(&headers, addr.ip());
    let policy = settings::runtime_policy(&state).await?;
    rate_limit::enforce(
        &state,
        "auth_forgot_ip",
        &ip.to_string(),
        policy.rate_limits.forgot_password_ip_per_15_minutes,
        15 * 60,
        "找回密码请求过于频繁，请稍后再试",
    )
    .await?;
    rate_limit::enforce(
        &state,
        "auth_forgot_email",
        &req.email.to_lowercase(),
        policy.rate_limits.forgot_password_email_per_15_minutes,
        15 * 60,
        "找回密码请求过于频繁，请稍后再试",
    )
    .await?;

    let requested_email = req.email.to_lowercase();
    let mut tx = state
        .db
        .begin()
        .await
        .map_err(|err| AppError::new(ErrorCode::Internal, "开启事务失败").with_source(err))?;
    let user = sqlx::query_as::<_, UserRow>(
        r#"
        SELECT
          id,
          email,
          username,
          password_hash,
          role::text AS role,
          is_active,
          email_verified_at,
          token_version
        FROM users
        WHERE email = $1
        FOR UPDATE
        "#,
    )
    .bind(&requested_email)
    .fetch_optional(&mut *tx)
    .await
    .map_err(|err| AppError::new(ErrorCode::Internal, "查询用户失败").with_source(err))?;

    let delivery = if let Some(user) = user {
        let reset_token = credentials::generate_token();
        let token_hash = credentials::sha256_hex(&reset_token);
        let expires_at_db = Utc::now() + Duration::hours(1);

        sqlx::query(
            r#"
            INSERT INTO password_resets (user_id, token_hash, expires_at)
            VALUES ($1, $2, $3)
            "#,
        )
        .bind(user.id)
        .bind(token_hash)
        .bind(expires_at_db)
        .execute(&mut *tx)
        .await
        .map_err(|err| {
            AppError::new(ErrorCode::Internal, "创建密码重置记录失败").with_source(err)
        })?;

        let reset_url = format!(
            "{}/reset-password?token={}",
            state.config.public_base_url, reset_token
        );
        Some((user.email, user.username, reset_url))
    } else {
        None
    };
    tx.commit().await.map_err(|err| {
        AppError::new(ErrorCode::Internal, "提交密码找回事务失败").with_source(err)
    })?;

    if let Some((email, username, reset_url)) = delivery {
        let _ = mail::send_password_reset_email(&state, &email, &username, &reset_url).await;
    }

    Ok(Json(Envelope {
        success: true,
        data: MessageResponse {
            message: "如果该邮箱已注册，您将收到重置邮件".to_string(),
        },
    }))
}

#[derive(Debug, Deserialize)]
struct ResetPasswordRequest {
    token: String,
    new_password: String,
}

async fn reset_password(
    State(state): State<AppState>,
    ConnectInfo(addr): ConnectInfo<SocketAddr>,
    headers: HeaderMap,
    Json(req): Json<ResetPasswordRequest>,
) -> Result<Json<Envelope<MessageResponse>>, AppError> {
    if req.token.trim().is_empty() {
        return Err(AppError::new(ErrorCode::InvalidRequest, "token 不能为空"));
    }
    credentials::validate_password(&req.new_password)?;

    let ip = context::client_ip(&headers, addr.ip());
    let policy = settings::runtime_policy(&state).await?;
    rate_limit::enforce(
        &state,
        "auth_reset_ip",
        &ip.to_string(),
        policy.rate_limits.password_reset_ip_per_15_minutes,
        15 * 60,
        "重置密码请求过于频繁，请稍后再试",
    )
    .await?;
    rate_limit::enforce(
        &state,
        "auth_reset_token",
        &req.token,
        policy.rate_limits.password_reset_token_per_15_minutes,
        15 * 60,
        "该重置链接尝试次数过多，请重新申请",
    )
    .await?;

    let token_hash = credentials::sha256_hex(&req.token);
    let now = Utc::now();
    let reset_user_id: Option<Uuid> = sqlx::query_scalar(
        r#"
        SELECT user_id
        FROM password_resets
        WHERE token_hash = $1
          AND used_at IS NULL
          AND expires_at > $2
        "#,
    )
    .bind(&token_hash)
    .bind(now)
    .fetch_optional(&state.db)
    .await
    .map_err(|err| AppError::new(ErrorCode::Internal, "重置密码失败").with_source(err))?;
    let Some(reset_user_id) = reset_user_id else {
        return Err(AppError::new(ErrorCode::InvalidToken, "Token 无效或已过期"));
    };

    let password_hash = credentials::hash_password(&req.new_password).await?;

    let mut tx = state
        .db
        .begin()
        .await
        .map_err(|err| AppError::new(ErrorCode::Internal, "开启事务失败").with_source(err))?;

    let locked_user: Option<Uuid> =
        sqlx::query_scalar("SELECT id FROM users WHERE id = $1 FOR UPDATE")
            .bind(reset_user_id)
            .fetch_optional(&mut *tx)
            .await
            .map_err(|err| AppError::new(ErrorCode::Internal, "锁定用户失败").with_source(err))?;
    if locked_user.is_none() {
        return Err(AppError::new(ErrorCode::InvalidToken, "Token 无效或已过期"));
    }

    let user_id: Option<Uuid> = sqlx::query_scalar(
        r#"
        SELECT user_id
        FROM password_resets
        WHERE token_hash = $1
          AND used_at IS NULL
          AND expires_at > $2
        FOR UPDATE
        "#,
    )
    .bind(&token_hash)
    .bind(now)
    .fetch_optional(&mut *tx)
    .await
    .map_err(|err| AppError::new(ErrorCode::Internal, "重置密码失败").with_source(err))?;

    let Some(user_id) = user_id else {
        return Err(AppError::new(ErrorCode::InvalidToken, "Token 无效或已过期"));
    };
    if user_id != reset_user_id {
        return Err(AppError::new(ErrorCode::InvalidToken, "Token 无效或已过期"));
    }

    sqlx::query(
        "UPDATE users SET password_hash = $1, token_version = token_version + 1, updated_at = NOW() WHERE id = $2",
    )
        .bind(password_hash)
        .bind(user_id)
        .execute(&mut *tx)
        .await
        .map_err(|err| AppError::new(ErrorCode::Internal, "更新密码失败").with_source(err))?;

    credentials::invalidate_account_recovery(&mut tx, user_id, now).await?;

    tx.commit()
        .await
        .map_err(|err| AppError::new(ErrorCode::Internal, "提交事务失败").with_source(err))?;

    Ok(Json(Envelope {
        success: true,
        data: MessageResponse {
            message: "密码重置成功".to_string(),
        },
    }))
}

fn map_unique_violation(err: sqlx::Error) -> AppError {
    if let sqlx::Error::Database(db_err) = &err {
        if let Some(code) = db_err.code() {
            if code == "23505" {
                return AppError::new(ErrorCode::InvalidRequest, "邮箱或用户名已存在");
            }
        }
    }
    AppError::new(ErrorCode::Internal, "数据库操作失败").with_source(err)
}