<?php

use App\Enums\SystemRole;
use App\Models\User;
use App\Support\SystemRolePermissions;
use Illuminate\Database\Migrations\Migration;
use Illuminate\Support\Facades\DB;
use Spatie\Permission\Models\Permission;
use Spatie\Permission\Models\Role;
use Spatie\Permission\PermissionRegistrar;

return new class extends Migration
{
    /**
     * Run the migrations.
     */
    public function up(): void
    {
        app(PermissionRegistrar::class)->forgetCachedPermissions();

        setPermissionsTeamId(null);
        $masterRole = Role::query()->whereNull('tenant_id')->firstOrCreate([
            'name' => SystemRole::MasterAdmin->value,
            'guard_name' => 'web',
        ]);
        $masterRole->syncPermissions(Permission::all());

        DB::table('tenants')->orderBy('id')->eachById(function (object $tenant): void {
            setPermissionsTeamId($tenant->id);
            $existingAdminIds = DB::table('model_has_roles')
                ->join('roles', 'roles.id', '=', 'model_has_roles.role_id')
                ->where('model_has_roles.tenant_id', $tenant->id)
                ->whereIn('roles.name', ['TENANT OWNER', SystemRole::TenantAdmin->value])
                ->pluck('model_has_roles.model_id');

            $roles = [];
            foreach (SystemRolePermissions::tenantRoles() as $name => $permissions) {
                $role = Role::findOrCreate($name, 'web', $tenant->id);
                $role->syncPermissions($permissions);
                $roles[$name] = $role;
            }

            DB::table('model_has_roles')->where('tenant_id', $tenant->id)->delete();

            User::withoutGlobalScope('tenant')->where('tenant_id', $tenant->id)->each(function (User $user) use ($existingAdminIds, $roles): void {
                $role = $existingAdminIds->contains($user->id)
                    ? $roles[SystemRole::TenantAdmin->value]
                    : $roles[SystemRole::TenantUser->value];
                $user->assignRole($role);
            });

            Role::query()
                ->where('tenant_id', $tenant->id)
                ->whereNotIn('name', [SystemRole::TenantAdmin->value, SystemRole::TenantUser->value])
                ->delete();
        });

        Role::query()->whereNull('tenant_id')->where('name', 'SUPER ADMIN')->delete();
        app(PermissionRegistrar::class)->forgetCachedPermissions();
    }

    /**
     * Reverse the migrations.
     */
    public function down(): void
    {
        // Standardizing security roles is intentionally irreversible.
    }
};