<?php

namespace App\Http\Controllers\Auth;

use App\Http\Controllers\Controller;
use App\Models\User;
use App\Services\AuditService;
use App\Services\Auth\TenantLoginResolver;
use App\Services\Hr\EmployeeAccessRevocationService;
use App\Services\TenantRoleService;
use App\Services\TwoFactorService;
use App\Services\UserSessionService;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Auth;
use Illuminate\Support\Facades\Log;
use Illuminate\Validation\ValidationException;

class WebLoginController extends Controller
{
    public function __construct(
        protected AuditService $audit,
        protected TenantLoginResolver $loginResolver,
    ) {}

    public function showLoginForm()
    {
        return response()
            ->view('auth.login')
            ->header('Cache-Control', 'no-cache, no-store, must-revalidate')
            ->header('Pragma', 'no-cache')
            ->header('Expires', '0');
    }

    public function login(Request $request, TwoFactorService $twoFactor, UserSessionService $sessions, EmployeeAccessRevocationService $accessRevocation)
    {
        $request->validate([
            'company' => 'nullable|string|max:100',
            'email' => 'required|email',
            'password' => 'required',
        ]);

        $email = (string) $request->email;
        $password = (string) $request->password;
        $company = $request->input('company');

        $user = $this->loginResolver->findUserByEmailAndPassword($company, $email, $password);

        if (! $user) {
            Log::channel('hrms')->info('Web login failed', ['email' => $email, 'ip' => $request->ip()]);
            $this->audit->log('auth.login_failed', null, [
                'email' => $email,
                'company' => $company,
            ], null, null);

            if ($this->loginResolver->hasMultiplePasswordMatches($company, $email, $password)) {
                throw ValidationException::withMessages([
                    'email' => __('Unable to Login. Please contact your administrator.'),
                ]);
            }

            throw ValidationException::withMessages([
                'email' => __('The provided credentials are incorrect.'),
            ]);
        }

        $accessRevocation->deactivateIfLastWorkingDatePassed($user);
        $user->refresh();

        if ($user->status === User::STATUS_INACTIVE) {
            Log::channel('hrms')->warning('Web login rejected (account inactive)', ['user_id' => $user->id, 'email' => $user->email]);
            $this->audit->log('auth.login_inactive', $user, [], $user->company_id, $user->id);
            throw ValidationException::withMessages([
                'email' => __('Please contact the administrator.'),
            ]);
        }

        if (! $user->allow_login) {
            Log::channel('hrms')->warning('Web login rejected (account disabled)', ['user_id' => $user->id, 'email' => $user->email]);
            $this->audit->log('auth.login_disabled', $user, [], $user->company_id, $user->id);
            throw ValidationException::withMessages([
                'email' => __('Login is disabled for this account.'),
            ]);
        }

        Auth::login($user, $request->boolean('remember'));
        TenantRoleService::assignEmployeeRoleIfMissing($user);

        if ($twoFactor->requiresChallenge($user)) {
            Auth::logout();
            $request->session()->put('login.id', $user->id);
            $request->session()->put('login.remember', $request->boolean('remember'));

            return $twoFactor->beginLoginChallenge($user) === 'enroll'
                ? redirect()->route('two-factor.enroll')
                : redirect()->route('two-factor.challenge');
        }

        $request->session()->regenerate();
        $sessions->recordLogin($user, $request);
        Log::channel('hrms')->info('Web login success', ['user_id' => $user->id, 'email' => $user->email]);
        $this->audit->log('auth.login', $user, [], $user->company_id, $user->id);
        if ($user->is_superadmin ?? false) {
            return redirect()->intended(route('superadmin.dashboard'));
        }

        return redirect()->intended(route('dashboard'));
    }

    public function logout(Request $request)
    {
        $user = $request->user();
        $userId = $user?->id;
        $companyId = $user?->company_id;
        Auth::logout();
        $request->session()->invalidate();
        $request->session()->regenerateToken();
        if ($userId) {
            Log::channel('hrms')->info('Web logout', ['user_id' => $userId]);
            $this->audit->log('auth.logout', null, [], $companyId, $userId);
        }

        return redirect('/');
    }
}