package com.prudas.app.dto;

import jakarta.validation.constraints.Email;
import jakarta.validation.constraints.NotBlank;
import jakarta.validation.constraints.Pattern;
import jakarta.validation.constraints.Size;

/**
 * Public contact-form submission. Every field is validated and length
 * capped server-side — the frontend's own validation is a UX convenience
 * only and must never be trusted as the security boundary.
 */
public record ContactRequest(
        @NotBlank @Size(max = 150) String name,

        @NotBlank @Email @Size(max = 255) String email,

        @Pattern(regexp = "^$|^[0-9+()\\-\\s]{6,30}$", message = "invalid phone number") String phone,

        @Size(max = 255) String subject,

        @NotBlank @Size(max = 5000) String message,

        // Honeypot field: must stay empty. Bots that auto-fill every input
        // trip this; real browsers never populate a visually-hidden field.
        String website,

        // Optional Google reCAPTCHA v3 token; verified server-side when
        // app.recaptcha.enabled=true.
        String recaptchaToken
) {
}