(function() {
    'use strict';

    // URL safety: this file only fetches a hardcoded relative API path
    // ('/auth/validate-password') — no user-supplied URLs. See url-validator.js
    // for dynamic URL validation.

    /**
     * Validate password strength via server API.
     * Single source of truth — calls PasswordValidator.validate_strength() on server.
     * @param {string} password - The password to validate
     * @param {string} csrfToken - CSRF token from the form
     * @returns {Promise<{valid: boolean, errors: string[]}>}
     */
    async function validatePasswordViaAPI(password, csrfToken) {
        const formData = new FormData();
        formData.append('password', password);
        formData.append('csrf_token', csrfToken);
        try {
            const resp = await fetch('/auth/validate-password', {
                method: 'POST',
                body: formData,
            });
            if (!resp.ok) {
                // CSRF expiry or server error — let server-side catch it on submit
                return { valid: true, errors: [] };
            }
            return await resp.json();
        } catch (e) {
            // Network error — let server-side validation catch it on submit
            return { valid: true, errors: [] };
        }
    }

    window.validatePasswordViaAPI = validatePasswordViaAPI;
})();
