<?php

namespace App\Http\Controllers\Auth;

use App\Http\Controllers\Controller;
use App\Mail\TwoFactorCode;
use App\Models\User;
use App\Models\UserTrustedDevice;
use Illuminate\Foundation\Auth\AuthenticatesUsers;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Auth;
use Illuminate\Support\Facades\Mail;
use Illuminate\Support\Str;
use Illuminate\Validation\ValidationException;

class LoginController extends Controller
{
    /*
    |--------------------------------------------------------------------------
    | Login Controller
    |--------------------------------------------------------------------------
    |
    | This controller handles authenticating users for the application and
    | redirecting them to your home screen. The controller uses a trait
    | to conveniently provide its functionality to your applications.
    |
    */

    use AuthenticatesUsers;

    /**
     * Where to redirect users after login.
     *
     * @var string
     */
    protected $redirectTo = '/home';

    /**
     * Create a new controller instance.
     *
     * @return void
     */
    public function __construct()
    {
        $this->middleware('guest')->except('logout');
    }

    /**
     * Attempt to log the user into the application.
     *
     * @param  \Illuminate\Http\Request  $request
     * @return bool
     */
    protected function attemptLogin(Request $request)
    {
        // First check if user exists with email and password
        $credentials = $request->only($this->username(), 'password');

        if (Auth::validate($credentials)) {
            // User credentials are correct, now check if account is active
            $user = User::where($this->username(), $request->{$this->username()})->first();

            if ($user && $user->state !== 'active') {
                // Store that account is inactive for custom error message
                $request->session()->put('account_inactive', true);
                return false;
            }

            // Account is active, proceed with login
            return $this->guard()->attempt(
                array_merge($credentials, ['state' => 'active']),
                $request->filled('remember')
            );
        }

        return false;
    }

    /**
     * Get the failed login response instance.
     *
     * @param  \Illuminate\Http\Request  $request
     * @return \Symfony\Component\HttpFoundation\Response
     *
     * @throws \Illuminate\Validation\ValidationException
     */
    protected function sendFailedLoginResponse(Request $request)
    {
        // Check if the failure was due to inactive account
        if ($request->session()->has('account_inactive')) {
            $request->session()->forget('account_inactive');

            throw ValidationException::withMessages([
                $this->username() => ['Your account is not active. Please contact the administrator.'],
            ]);
        }

        // Default invalid credentials message
        throw ValidationException::withMessages([
            $this->username() => [trans('auth.failed')],
        ]);
    }

    /**
     * The user has been authenticated.
     * Checks for trusted device; if not trusted, initiates two-factor authentication flow.
     *
     * @param  \Illuminate\Http\Request  $request
     * @param  mixed  $user
     * @return mixed
     */
    protected function authenticated(Request $request, $user)
    {
        // If the device has a valid trusted token, skip two-factor authentication
        $deviceToken = $request->cookie('intranet_user_two_factor_device_token');
        if ($deviceToken) {
            $trusted = UserTrustedDevice::where('user_id', $user->id)
                ->where('device_token', $deviceToken)
                ->first();

            if ($trusted) {
                return null; // Trusted device — proceed with normal login redirect
            }
        }

        // Generate a 6-digit code valid for 5 minutes
        $code = str_pad(random_int(0, 999999), 6, '0', STR_PAD_LEFT);
        $user->two_factor_code = $code;
        $user->two_factor_expires_at = now()->addMinutes(5);
        $user->save();

        // Persist pending auth info across the logout
        $request->session()->put('two_factor_user_id', $user->id);
        $request->session()->put('two_factor_remember', $request->boolean('remember'));

        // Send the code and interrupt the login until two-factor authentication is verified
        Mail::to($user->email)->send(new TwoFactorCode($code));

        $this->guard()->logout();

        return redirect()->route('two_factor.form');
    }

    /**
     * Show the two-factor authentication verification form.
     *
     * @return \Illuminate\Http\Response
     */
    public function showTwoFactorForm()
    {
        if (!session('two_factor_user_id')) {
            return redirect()->route('login');
        }

        return view('auth.two-factor');
    }

    /**
     * Verify the two-factor authentication code submitted by the user.
     *
     * @param  \Illuminate\Http\Request  $request
     * @return \Illuminate\Http\Response
     */
    public function verifyTwoFactor(Request $request)
    {
        $userId = $request->session()->get('two_factor_user_id');

        if (!$userId) {
            return redirect()->route('login');
        }

        $user = User::find($userId);

        if (!$user) {
            return redirect()->route('login');
        }

        $request->validate([
            'code' => 'required|digits:6',
        ]);

        $codeMatches = $user->two_factor_code === $request->input('code');
        $codeValid = $user->two_factor_expires_at && $user->two_factor_expires_at->isFuture();

        if (!$codeMatches || !$codeValid) {
            throw ValidationException::withMessages([
                'code' => [trans('auth.two_factor_invalid_code')],
            ]);
        }

        // Invalidate the used code
        $user->two_factor_code = null;
        $user->two_factor_expires_at = null;
        $user->save();

        $remember = $request->session()->get('two_factor_remember', false);
        $request->session()->forget(['two_factor_user_id', 'two_factor_remember']);

        // Complete the login
        $this->guard()->login($user, $remember);

        // Redirect to the originally intended URL (e.g. /oauth/authorize)
        $response = redirect()->intended($this->redirectTo);

        // Optionally trust this device for the configured number of days
        if ($request->boolean('trust_device')) {
            $deviceToken = Str::random(60);
            UserTrustedDevice::create([
                'user_id' => $user->id,
                'device_token' => $deviceToken,
            ]);

            $days = config('auth.two_factor_remember_days', 60);
            // Bind explicitly to this host so the cookie never leaks to other apps under the wildcard SESSION_DOMAIN
            $response->withCookie(
                cookie('intranet_user_two_factor_device_token', $deviceToken, $days * 24 * 60, '/', $request->getHost(), $request->secure(), true, false, 'Lax')
            );
        }

        return $response;
    }
}