<?php

namespace App\Http\Controllers;

use App\Enums\SystemRole;
use App\Models\TenantDeviceSetting;
use Illuminate\Http\JsonResponse;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Hash;
use Illuminate\Support\Facades\Log;
use Illuminate\Validation\ValidationException;

class RevealTenantBasePasswordController extends Controller
{
    public function __invoke(Request $request): JsonResponse
    {
        abort_unless($request->user()->hasRole(SystemRole::TenantAdmin->value), 403);
        $data = $request->validate(['current_password' => ['required', 'string']]);
        if (! Hash::check($data['current_password'], $request->user()->password)) {
            throw ValidationException::withMessages(['current_password' => 'Password login tidak sesuai.']);
        }

        $setting = TenantDeviceSetting::where('tenant_id', $request->user()->tenant_id)->firstOrFail();
        Log::notice('Tenant Admin revealed the base device password.', [
            'tenant_id' => $request->user()->tenant_id,
            'user_id' => $request->user()->id,
        ]);

        return response()->json(['password' => $setting->base_password])
            ->header('Cache-Control', 'no-store, private')
            ->header('Pragma', 'no-cache');
    }
}