"""Login form (Chapter 12). CSRF handled automatically via form.hidden_tag()
(Flask-WTF, Ch12's CSRF requirement)."""
from __future__ import annotations

from flask_wtf import FlaskForm
from wtforms import PasswordField, StringField, SubmitField
from wtforms.validators import DataRequired


class LoginForm(FlaskForm):
    # NOTE: no Email() validator — that validator requires the extra
    # `email-validator` package. Login checks the value against a stored
    # user row anyway, so a malformed email simply fails to match rather
    # than needing format validation up front; kept simple to avoid a new
    # dependency.
    email = StringField("Email", validators=[DataRequired()])
    password = PasswordField("Password", validators=[DataRequired()])
    submit = SubmitField("Log in")