import { IsNotEmpty, IsString, MaxLength } from 'class-validator';

/**
 * Body of POST customer/me/complete-profile.
 *
 * The three ids are the reference's exactly
 * (henza_server Major/CustomerController::complete:73-79):
 *
 *   'business_license_image_id' => 'required',
 *   'shop_image_id'            => 'required',
 *   'ncode_image_id'           => 'required',
 *
 * and the PWA sends those same three keys (completeProfile.vue:136-140, :193).
 * They are kept verbatim rather than camelCased so the app's payload is
 * byte-identical to the reference's.
 *
 * Deliberately NOT accepted: anything else. The reference did
 * `$customer->update($request->all())` (:87), so ANY column the caller named —
 * `gram_level`, `percent`, `active`, `remain` — was written straight onto the
 * customer row from the app. That is a privilege-escalation and money hole, not
 * a feature, so only these three ids are read (whitelist, not mass-assign).
 * Recorded in ISSUES.md as SEC-14.
 */
export class CompleteProfileDto {
  @IsString()
  @IsNotEmpty({ message: 'تصویر جواز کسب الزامی است' })
  @MaxLength(64)
  business_license_image_id!: string;

  @IsString()
  @IsNotEmpty({ message: 'تصویر سردر مغازه الزامی است' })
  @MaxLength(64)
  shop_image_id!: string;

  @IsString()
  @IsNotEmpty({ message: 'تصویر کارت ملی الزامی است' })
  @MaxLength(64)
  ncode_image_id!: string;
}