<?php

namespace App\Services\Devices;

use App\Models\Device;
use App\Models\TenantDeviceSetting;
use App\Network\Clients\RouterOs\RouterOsApiClient;
use App\Network\Drivers\Mikrotik\MikrotikDriver;
use RuntimeException;

class MikrotikActivationService
{
    public function activate(Device $device): array
    {
        abort_unless($device->vendor?->slug === 'mikrotik' && $device->hasConnection('routeros_api'), 422, 'Aktivasi otomatis saat ini hanya mendukung MikroTik RouterOS API.');
        $setting = TenantDeviceSetting::where('tenant_id', $device->tenant_id)->first();
        if (! $setting) {
            throw new RuntimeException('BASE_SETTING_REQUIRED: atur Base User dan Password terlebih dahulu.');
        }
        $credential = $device->credentials()->where('is_active', true)->orderByDesc('is_master')->first();
        if (! $credential) {
            throw new RuntimeException('CREDENTIAL_REQUIRED: tambahkan credential login perangkat terlebih dahulu.');
        }

        $client = $this->client($device, $credential->username, $credential->password, $setting);
        $driver = new MikrotikDriver($client);
        $deviceInfo = $driver->getDeviceInfo();
        $provisioned = $driver->provisionBaseAccess($setting->base_username, $setting->base_password);

        // Never clean existing accounts until the new RADIQ account is proven usable.
        $managementDriver = new MikrotikDriver($this->client($device, $setting->base_username, $setting->base_password, $setting));
        $managementDriver->testConnection();
        $cleanup = $device->remove_legacy_users_on_activation
            ? $managementDriver->cleanupLegacyUsers($setting->base_username)
            : ['deleted' => [], 'preserved' => []];

        $device->credentials()->update(['is_master' => false]);
        $device->credentials()->updateOrCreate(
            ['name' => 'Base User RADIQ'],
            [
                'tenant_id' => $device->tenant_id,
                'username' => $setting->base_username,
                'password' => $setting->base_password,
                'connection_type' => 'routeros_api',
                'privilege_type' => 'master',
                'is_master' => true,
                'is_active' => true,
                'last_verified_at' => now(),
            ],
        );

        return $provisioned + ['device_info' => $deviceInfo, 'cleanup' => $cleanup];
    }

    private function client(Device $device, string $username, string $password, TenantDeviceSetting $setting): RouterOsApiClient
    {
        return new RouterOsApiClient($device->management_address, $device->portFor('routeros_api'), $username, $password, $setting->connection_timeout, $setting->use_tls, $setting->verify_tls);
    }
}