<?php

namespace App\Http\Controllers\Auth;

use App\Http\Controllers\Controller;
use App\Services\TenantRoleService;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Auth;
use Illuminate\Support\Facades\Log;
use Illuminate\Validation\ValidationException;

class WebLoginController extends Controller
{
    public function showLoginForm()
    {
        return response()
            ->view('auth.login')
            ->header('Cache-Control', 'no-cache, no-store, must-revalidate')
            ->header('Pragma', 'no-cache')
            ->header('Expires', '0');
    }

    public function login(Request $request)
    {
        $request->validate([
            'email' => 'required|email',
            'password' => 'required',
        ]);

        if (! Auth::attempt($request->only('email', 'password'), $request->boolean('remember'))) {
            Log::channel('hrms')->info('Web login failed', ['email' => $request->email, 'ip' => $request->ip()]);
            throw ValidationException::withMessages([
                'email' => __('The provided credentials are incorrect.'),
            ]);
        }

        $user = Auth::user();
        if (! ($user->login_enabled && $user->allow_login)) {
            Log::channel('hrms')->warning('Web login rejected (account disabled)', ['user_id' => $user->id, 'email' => $user->email]);
            Auth::logout();
            throw ValidationException::withMessages([
                'email' => __('Login is disabled for this account.'),
            ]);
        }

        TenantRoleService::assignEmployeeRoleIfMissing($user);

        $request->session()->regenerate();
        Log::channel('hrms')->info('Web login success', ['user_id' => $user->id, 'email' => $user->email]);
        if ($user->is_superadmin ?? false) {
            return redirect()->intended(route('superadmin.dashboard'));
        }
        return redirect()->intended(route('dashboard'));
    }

    public function logout(Request $request)
    {
        $userId = $request->user()?->id;
        Auth::logout();
        $request->session()->invalidate();
        $request->session()->regenerateToken();
        if ($userId) {
            Log::channel('hrms')->info('Web logout', ['user_id' => $userId]);
        }
        return redirect('/');
    }
}