<?php

namespace App\Http\Controllers;

use App\Http\Requests\StoreDeviceCredentialRequest;
use App\Http\Requests\UpdateDeviceCredentialRequest;
use App\Models\Device;
use App\Models\DeviceCredential;
use Illuminate\Http\RedirectResponse;

class DeviceCredentialController extends Controller
{
    public function store(StoreDeviceCredentialRequest $request, Device $device): RedirectResponse
    {
        $this->ensureOwned($device);
        $data = $request->validated();
        $data['is_master'] = $data['privilege_type'] === 'master' || ($data['is_master'] ?? false);
        abort_if(($data['is_master'] ?? false) && ! $request->user()->can('device.master_account.manage'), 403);
        DeviceCredential::create($data + ['tenant_id' => $request->user()->tenant_id, 'device_id' => $device->id, 'created_by' => $request->user()->id, 'updated_by' => $request->user()->id]);

        return back()->with('success', 'Credential perangkat berhasil disimpan secara terenkripsi.');
    }

    public function update(UpdateDeviceCredentialRequest $request, Device $device, DeviceCredential $credential): RedirectResponse
    {
        $this->ensureOwned($device, $credential);
        abort_if($credential->is_master && ! $request->user()->can('device.master_account.manage'), 403);
        $data = $request->validated();
        $data['is_master'] = $data['privilege_type'] === 'master' || ($data['is_master'] ?? false);
        if (blank($data['password'] ?? null)) {
            unset($data['password']);
        }
        if (blank($data['enable_password'] ?? null)) {
            unset($data['enable_password']);
        }
        $credential->update($data + ['updated_by' => $request->user()->id]);

        return back()->with('success', 'Credential perangkat berhasil diperbarui.');
    }

    public function destroy(Device $device, DeviceCredential $credential): RedirectResponse
    {
        $this->ensureOwned($device, $credential);
        abort_unless(request()->user()->can('device.credential.delete'), 403);
        abort_if($credential->is_master && ! request()->user()->can('device.master_account.manage'), 403);
        $credential->delete();

        return back()->with('success', 'Credential perangkat berhasil dihapus.');
    }

    private function ensureOwned(Device $device, ?DeviceCredential $credential = null): void
    {
        abort_if(request()->user()->is_platform_admin || $device->tenant_id !== request()->user()->tenant_id, 404);
        abort_if($credential && ($credential->tenant_id !== $device->tenant_id || $credential->device_id !== $device->id), 404);
    }
}