<?php

namespace App\Http\Controllers\Admin\Auth;

use App\Http\Controllers\Controller;
use App\Mail\TwoFactorCode;
use App\Models\BackendAuth\BackendTrustedDevice;
use App\Models\BackendAuth\BackendUser;
use Illuminate\Foundation\Auth\AuthenticatesUsers;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Auth;
use Illuminate\Support\Facades\Mail;
use Illuminate\Support\Str;
use Illuminate\Validation\ValidationException;

class LoginController extends Controller
{

    use AuthenticatesUsers;

    /**
     * Where to redirect users after login.
     *
     * @var string
     */
    protected $redirectTo = '/admin';

    /**
     * Create a new controller instance.
     *
     * @return void
     */
    public function __construct()
    {
        $this->middleware('guest')->except('logout');
        $this->middleware('guest:admin')->except('logout');
    }

    /**
     * Show the application's login form.
     *
     * @return \Illuminate\Http\Response
     */
    public function showLoginForm()
    {
        return view('admin.pages.auth.login');
    }

    /**
     * Show the two-factor authentication verification form.
     *
     * @return \Illuminate\Http\Response
     */
    public function showTwoFactorForm()
    {
        if (!session('two_factor_user_id')) {
            return redirect()->route('admin.login');
        }

        return view('admin.pages.auth.two-factor');
    }

    /**
     * Get the guard to be used during authentication.
     *
     * @return \Illuminate\Contracts\Auth\StatefulGuard
     */
    protected function guard()
    {
        return Auth::guard('admin');
    }

    /**
     * Get the login username to be used by the controller.
     *
     * @return string
     */
    public function username()
    {
        return 'username';
    }

    /**
     * Validate the user login request.
     *
     * @param  \Illuminate\Http\Request  $request
     * @return void
     *
     * @throws \Illuminate\Validation\ValidationException
     */
    protected function validateLogin(Request $request)
    {

        $request->validate([
            $this->username() => 'required|string',
            'password' => 'required|string',
            'g-recaptcha-response' => 'required'
        ]);

        $recaptcha = checkRecaptcha($request->input('g-recaptcha-response'), 'login_admin');

        if (!$recaptcha) {
            throw ValidationException::withMessages([
                'error' => ['Invalid Recaptcha'],
            ]);
        }
    }

    /**
     * The user has been authenticated.
     * Checks for trusted device; if not trusted, initiates two-factor authentication flow.
     *
     * @param  \Illuminate\Http\Request  $request
     * @param  mixed  $user
     * @return mixed
     */
    protected function authenticated(Request $request, $user)
    {
        // If the device has a valid trusted token, skip two-factor authentication
        $deviceToken = $request->cookie('two_factor_device_token');
        if ($deviceToken) {
            $trusted = BackendTrustedDevice::where('backend_user_id', $user->id)
                ->where('device_token', $deviceToken)
                ->first();

            if ($trusted) {
                return null; // Trusted device — proceed with normal login redirect
            }
        }

        // Generate a 6-digit code valid for 5 minutes
        $code = str_pad(random_int(0, 999999), 6, '0', STR_PAD_LEFT);
        $user->two_factor_code = $code;
        $user->two_factor_expires_at = now()->addMinutes(5);
        $user->save();

        // Persist pending auth info across the logout
        $request->session()->put('two_factor_user_id', $user->id);
        $request->session()->put('two_factor_remember', $request->boolean('remember'));

        // Send the code and interrupt the login until two-factor authentication is verified
        Mail::to($user->email)->send(new TwoFactorCode($code));

        $this->guard()->logout();

        return redirect()->route('admin.two_factor.form');
    }

    /**
     * Verify the two-factor authentication code submitted by the user.
     *
     * @param  \Illuminate\Http\Request  $request
     * @return \Illuminate\Http\Response
     */
    public function verifyTwoFactor(Request $request)
    {
        $userId = $request->session()->get('two_factor_user_id');

        if (!$userId) {
            return redirect()->route('admin.login');
        }

        $user = BackendUser::find($userId);

        if (!$user) {
            return redirect()->route('admin.login');
        }

        $request->validate([
            'code' => 'required|digits:6',
        ]);

        $codeMatches = $user->two_factor_code === $request->input('code');
        $codeValid = $user->two_factor_expires_at && $user->two_factor_expires_at->isFuture();

        if (!$codeMatches || !$codeValid) {
            throw ValidationException::withMessages([
                'code' => [trans('auth.two_factor_invalid_code')],
            ]);
        }

        // Invalidate the used code
        $user->two_factor_code = null;
        $user->two_factor_expires_at = null;
        $user->save();

        $remember = $request->session()->get('two_factor_remember', false);
        $request->session()->forget(['two_factor_user_id', 'two_factor_remember']);

        // Complete the login
        $this->guard()->login($user, $remember);

        // redirect to intended page
        $response = redirect()->intended($this->redirectTo);

        // Optionally trust this device for the configured number of days
        if ($request->boolean('trust_device')) {
            $deviceToken = Str::random(60);
            BackendTrustedDevice::create([
                'backend_user_id' => $user->id,
                'device_token' => $deviceToken,
            ]);

            $days = config('auth.two_factor_remember_days', 60);
            $response->withCookie(
                cookie('two_factor_device_token', $deviceToken, $days * 24 * 60, '/', null, $request->secure(), true, false, 'Lax')
            );
        }

        return $response;
    }

    /**
     * The user has logged out of the application.
     *
     * @param  \Illuminate\Http\Request  $request
     * @return mixed
     */
    protected function loggedOut(Request $request)
    {
        return redirect()->route('admin.login');
    }
}