<?php

namespace App\Http\Controllers;

use App\Enums\SystemRole;
use App\Jobs\SyncDeviceBaseCredential;
use App\Models\Device;
use App\Models\TenantDeviceSetting;
use App\Models\TenantEncryptionKey;
use Illuminate\Http\RedirectResponse;
use Illuminate\Http\Request;
use Illuminate\Validation\Rules\Password;
use Inertia\Inertia;
use Inertia\Response;

class TenantDeviceSettingController extends Controller
{
    public function edit(Request $request): Response
    {
        abort_unless($request->user()->hasRole(SystemRole::TenantAdmin->value), 403);
        $setting = TenantDeviceSetting::where('tenant_id', $request->user()->tenant_id)->first();

        $key = TenantEncryptionKey::withoutGlobalScope('tenant')->where('tenant_id', $request->user()->tenant_id)->where('is_active', true)->first();

        return Inertia::render('devices/settings', [
            'setting' => $setting?->only(['base_username', 'use_tls', 'verify_tls', 'connection_timeout']),
            'hasPassword' => (bool) $setting,
            'encryptionKey' => $key?->only(['version', 'source', 'created_at']),
            'devices' => Device::with('vendor:id,name')->orderBy('name')->get(['id', 'name', 'device_vendor_id', 'base_sync_status', 'base_sync_error_code', 'base_sync_message', 'base_synced_at']),
        ]);
    }

    public function update(Request $request): RedirectResponse
    {
        abort_unless($request->user()->hasRole(SystemRole::TenantAdmin->value), 403);
        $setting = TenantDeviceSetting::where('tenant_id', $request->user()->tenant_id)->first();
        $data = $request->validate([
            'base_username' => ['required', 'regex:/^[A-Za-z0-9][A-Za-z0-9_.@#-]*[A-Za-z0-9]$/', 'max:64'],
            'base_password' => [$setting ? 'nullable' : 'required', 'confirmed', Password::min(12)->mixedCase()->numbers()->symbols()],
            'use_tls' => ['required', 'boolean'], 'verify_tls' => ['required', 'boolean'],
            'connection_timeout' => ['required', 'integer', 'between:3,30'],
        ]);
        if (blank($data['base_password'] ?? null)) {
            unset($data['base_password']);
        }
        $oldUsername = $setting?->base_username;
        $credentialChanged = ! $setting || $oldUsername !== $data['base_username'] || array_key_exists('base_password', $data);
        TenantDeviceSetting::updateOrCreate(['tenant_id' => $request->user()->tenant_id], $data);
        if ($credentialChanged) {
            Device::where('tenant_id', $request->user()->tenant_id)->where('is_active', true)->get(['id', 'tenant_id'])->each(function (Device $device) use ($oldUsername): void {
                $device->update(['base_sync_status' => 'queued', 'base_sync_error_code' => null, 'base_sync_message' => 'Perubahan Base User menunggu sinkronisasi.']);
                SyncDeviceBaseCredential::dispatch($device->tenant_id, $device->id, $oldUsername);
            });
        }

        return back()->with('success', $credentialChanged ? 'Base User tersimpan terenkripsi dan rotasi seluruh perangkat tenant dimasukkan ke queue.' : 'Pengaturan koneksi perangkat berhasil disimpan.');
    }
}