<?php

namespace App\Http\Controllers;

use App\Enums\SystemRole;
use App\Services\Encryption\TenantEnvelopeEncryption;
use Illuminate\Http\RedirectResponse;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Hash;

class TenantEncryptionController extends Controller
{
    public function __invoke(Request $request, TenantEnvelopeEncryption $encryption): RedirectResponse
    {
        abort_unless($request->user()->hasRole(SystemRole::TenantAdmin->value), 403);
        $data = $request->validate([
            'mode' => ['required', 'in:generated,manual'],
            'manual_key' => ['nullable', 'required_if:mode,manual', 'string', 'min:32', 'max:4096', 'confirmed'],
            'current_password' => ['required', 'string'],
        ]);
        abort_unless(Hash::check($data['current_password'], $request->user()->password), 422, 'Password akun Tenant Admin tidak valid.');
        $key = $encryption->rotate($request->user()->tenant_id, $data['mode'] === 'manual' ? $data['manual_key'] : null, $request->user()->id);

        return back()->with('success', "Encryption key tenant berhasil dirotasi ke versi {$key->version}. Semua secret database telah dienkripsi ulang.");
    }
}