<?php

declare(strict_types=1);

namespace Builder\Core\Http\Requests\Auth;

use Illuminate\Foundation\Http\FormRequest;

final class VerifyMfaRequest extends FormRequest
{
    public function authorize(): bool
    {
        return true;
    }

    /** @return array<string, mixed> */
    public function rules(): array
    {
        // Accept either a 6-digit TOTP code or a recovery code in the
        // XXXX-XXXX / XXXX-YYYY format issued by ConfirmMfaController.
        return [
            // Accept a 6-digit TOTP code or a hyphen-segmented recovery code
            // of the form XXXX-XXXX or XXXXXXXX-XXXXXXXX (case-insensitive
            // alphanumeric segments) issued by ConfirmMfaController.
            'code' => ['required', 'string', 'regex:/^(\d{6}|[\dA-Z]{4,12}(-[\dA-Z]{4,12})+)$/i'],
        ];
    }
}
