<?php

namespace App\Http\Controllers\Api;

use App\Http\Controllers\Controller;
use App\Models\User;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Auth;
use Illuminate\Support\Facades\DB;
use Illuminate\Support\Facades\Log;

class OAuthController extends Controller
{
    /**
     * Sanitize group names for Nextcloud compatibility
     * Removes special characters, accents, and formats the name properly
     */
    private function sanitizeGroupName($name)
    {
        // Remove accents and special characters
        $name = iconv('UTF-8', 'ASCII//TRANSLIT', $name);

        // Remove any remaining non-alphanumeric characters except spaces and hyphens
        $name = preg_replace('/[^a-zA-Z0-9\s\-]/', '', $name);

        // Replace multiple spaces with single space
        $name = preg_replace('/\s+/', ' ', $name);

        // Trim whitespace
        $name = trim($name);

        return $name;
    }

    /**
     * Get user information for OAuth/OpenID Connect
     * This endpoint will be used by Nextcloud to get user details
     */
    public function userInfo(Request $request)
    {
        $userId = Auth::guard('api')->id();

        if (!$userId) {
            return response()->json(['error' => 'Unauthorized'], 401);
        }

        // Get user with member relationship and committees/workgroups
        $user = User::with(['member', 'committees', 'workgroups'])->find($userId);

        if (!$user) {
            return response()->json(['error' => 'User not found'], 404);
        }

        return response()->json($this->getUserClaims($user));
    }

    /**
     * Get user claims for both userinfo endpoint and token enhancement
     */
    private function getUserClaims(User $user)
    {
        // Get user groups (committees and workgroups)
        $groups = [];

        // Add committees
        if ($user->committees) {
            foreach ($user->committees as $committee) {
                $sanitizedName = $this->sanitizeGroupName($committee->title);
                $type = !empty($committee->pivot->type) ? strtoupper($committee->pivot->type) : 'TO';
                $groups[] = $sanitizedName . ' - ' . $type;
            }
        }

        // Add workgroups
        if ($user->workgroups) {
            foreach ($user->workgroups as $workgroup) {
                $sanitizedName = $this->sanitizeGroupName($workgroup->title);
                $type = !empty($workgroup->pivot->type) ? strtoupper($workgroup->pivot->type) : 'TO';
                $groups[] = $sanitizedName . ' - ' . $type;
            }
        }

        // Check if user is admin (email ends with energytraderseurope.org or efet.org or eae.pt)
        $isAdmin = str_ends_with($user->email, '@energytraderseurope.org') ||
                    str_ends_with($user->email, '@efet.org') ||
                    str_ends_with($user->email, '@eae.pt');

        // Add admin group for admin users
        if ($isAdmin) {
            $groups[] = 'admin';
        }

        // Construct the full name for logging
        $fullName = ($user->name ?? '') . ' ' . ($user->last_name ?? '');

        // Return user info in OpenID Connect format compatible with Nextcloud
        return [
            // Standard OpenID Connect claims
            'sub' => ($isAdmin ? 'admin-' : 'user-') . $user->id, // Subject (user ID with prefix)
            'email' => $user->email,
            'email_verified' => $user->email_verified_at !== null,
            'name' => trim($fullName),
            'given_name' => $user->name ?? '',
            'family_name' => $user->last_name ?? '',
            'preferred_username' => $user->email,
            'updated_at' => $user->updated_at->timestamp,

            // Nextcloud specific claims (based on your configuration)
            'ownCloudGroups' => $groups, // Groups that Nextcloud will create
            'ownCloudAdmin' => false,
            'ownCloudQuota' => $isAdmin ? '10000000000' : '0',
            'uid' => (string) $user->id, // For LDAP proxy if you use it
            'picture' => $user->image ? getProfileImage($user->image, ['100x100'])->url ?? null : null,
        ];
    }

    /**
     * Handle logout for OAuth/OpenID Connect
     * This endpoint will be used by Nextcloud and frontend for logout
     */
    public function logout(Request $request)
    {
        // Get the redirect URL parameter from Nextcloud or frontend
        $redirectUrl = $request->get('redirect_uri') ??
                      $request->get('post_logout_redirect_uri') ??
                      config('app.frontend_url');

        // If user is authenticated via API, revoke the token
        if (Auth::guard('api')->check()) {
            $user = Auth::guard('api')->user();

            // Revoke all active tokens for this user using direct DB query
            DB::table('oauth_access_tokens')
                ->where('user_id', $user->id)
                ->where('revoked', false)
                ->update(['revoked' => true]);

            // Also revoke refresh tokens
            DB::table('oauth_refresh_tokens')
                ->where('access_token_id', function($query) use ($user) {
                    $query->select('id')
                          ->from('oauth_access_tokens')
                          ->where('user_id', $user->id);
                })
                ->where('revoked', false)
                ->update(['revoked' => true]);
        }

        // If user is authenticated via web, logout from web session
        if (Auth::guard('web')->check()) {
            Auth::guard('web')->logout();
        }

        // Clear all sessions for this user
        if ($request->hasSession()) {
            $request->session()->invalidate();
            $request->session()->regenerateToken();
        }

        // Clear any Laravel session cookies
        $response = redirect($redirectUrl);

        // Clear session-related cookies
        $response->withCookie(cookie()->forget('laravel_session'));
        $response->withCookie(cookie()->forget('XSRF-TOKEN'));
        $response->withCookie(cookie()->forget('efet_intranet_session'));

        return $response;
    }
}