import { z } from "zod";

// Shared between apps/api (server-side validation, source of truth) and
// apps/web (client-side validation for instant feedback before the round
// trip) — one set of rules, no risk of the two drifting apart.
// Messages are in French: this is the only place end users ever see zod's
// text (surfaced as-is in apps/web's forms), and the whole UI is French.

export const signupSchema = z.object({
  firstName: z.string().trim().min(1, "Le prénom est requis").max(100),
  lastName: z.string().trim().min(1, "Le nom est requis").max(100),
  email: z.string().trim().toLowerCase().email("Email invalide"),
  // Length only — not the place to enforce complexity rules; argon2 already
  // makes brute-forcing short-but-random passwords impractical, and
  // complexity rules mostly push users toward predictable patterns.
  password: z.string().min(8, "8 caractères minimum").max(200),
});
export type SignupInput = z.infer<typeof signupSchema>;

export const loginSchema = z.object({
  email: z.string().trim().toLowerCase().email("Email invalide"),
  password: z.string().min(1, "Le mot de passe est requis"),
});
export type LoginInput = z.infer<typeof loginSchema>;