<?php

namespace App\Http\Controllers;

use Illuminate\Http\Request;
use Illuminate\Support\Facades\Auth;
use Illuminate\Support\Facades\Mail;
use Illuminate\Support\Facades\Hash;
use Illuminate\Support\Facades\DB;
use Carbon\Carbon;
use App\Models\User;
use App\Mail\ForgotPasswordOtp;

class AuthController extends Controller
{
    public function showLogin()
    {
        if (Auth::check()) {
            return redirect()->route('dashboard');
        }
        return view('auth.login');
    }

    public function login(Request $request)
    {
        $credentials = $request->validate([
            'email' => 'required|email',
            'password' => 'required',
        ]);

        if (Auth::attempt($credentials, $request->boolean('remember'))) {
            // Block deactivated accounts immediately — do not let them in.
            if (! Auth::user()->is_active) {
                Auth::logout();
                $request->session()->invalidate();
                $request->session()->regenerateToken();
                return back()->withErrors(['email' => 'Your account has been deactivated. Please contact your administrator.'])->onlyInput('email');
            }

            $request->session()->regenerate();
            return redirect()->intended(route('dashboard'));
        }

        return back()->withErrors(['email' => 'Invalid credentials.'])->onlyInput('email');
    }

    public function logout(Request $request)
    {
        Auth::logout();
        $request->session()->invalidate();
        $request->session()->regenerateToken();
        return redirect()->route('login');
    }

    // ─────────────────────────────────────────────────────────────
    // Forgot Password — Step 1: Show email form
    // ─────────────────────────────────────────────────────────────
    public function showForgotPassword()
    {
        return view('auth.forgot-password');
    }

    // ─────────────────────────────────────────────────────────────
    // Forgot Password — Step 2: Send OTP
    // ─────────────────────────────────────────────────────────────
    public function sendOtp(Request $request)
    {
        $request->validate([
            'email' => 'required|email',
        ]);

        $user = User::where('email', $request->email)->first();

        // Always show the same success message to prevent email enumeration.
        if (! $user) {
            return back()->with('otp_sent', true)->with('otp_email', $request->email);
        }

        // Generate a 6-digit OTP.
        $otp = str_pad(random_int(0, 999999), 6, '0', STR_PAD_LEFT);

        // Delete any previous OTPs for this email.
        DB::table('password_otp_tokens')->where('email', $request->email)->delete();

        // Store the new OTP (expires in 10 minutes).
        DB::table('password_otp_tokens')->insert([
            'email'      => $request->email,
            'otp'        => $otp,
            'expires_at' => Carbon::now()->addMinutes(10),
            'created_at' => Carbon::now(),
            'updated_at' => Carbon::now(),
        ]);

        // Send the OTP email.
        try {
            Mail::to($user->email)->send(new ForgotPasswordOtp($otp, $user->name));
        } catch (\Exception $e) {
            // Log the error but don't expose it to the user.
            logger()->error('ForgotPasswordOtp mail failed: ' . $e->getMessage());
        }

        return redirect()->route('password.verify-otp', ['email' => $request->email])
                         ->with('otp_sent_success', true);
    }

    // ─────────────────────────────────────────────────────────────
    // Forgot Password — Step 3: Show OTP + new password form
    // ─────────────────────────────────────────────────────────────
    public function showVerifyOtp(Request $request)
    {
        $email = $request->query('email', $request->session()->get('otp_email'));

        if (! $email) {
            return redirect()->route('password.forgot');
        }

        return view('auth.verify-otp', compact('email'));
    }

    // ─────────────────────────────────────────────────────────────
    // Forgot Password — Step 4: Verify OTP and reset password
    // ─────────────────────────────────────────────────────────────
    public function resetPassword(Request $request)
    {
        $request->validate([
            'email'                 => 'required|email',
            'otp'                   => 'required|digits:6',
            'password'              => 'required|min:8|confirmed',
            'password_confirmation' => 'required',
        ]);

        $record = DB::table('password_otp_tokens')
            ->where('email', $request->email)
            ->first();

        if (! $record) {
            return back()->withErrors(['otp' => 'No OTP was sent to this email. Please request a new one.'])->withInput();
        }

        if ($record->otp !== $request->otp) {
            return back()->withErrors(['otp' => 'The OTP you entered is incorrect.'])->withInput();
        }

        if (Carbon::parse($record->expires_at)->isPast()) {
            DB::table('password_otp_tokens')->where('email', $request->email)->delete();
            return back()->withErrors(['otp' => 'This OTP has expired. Please request a new one.'])->withInput();
        }

        $user = User::where('email', $request->email)->first();

        if (! $user) {
            return back()->withErrors(['email' => 'No account found for this email address.'])->withInput();
        }

        // Update the user's password.
        $user->password = Hash::make($request->password);
        $user->save();

        // Remove the used OTP.
        DB::table('password_otp_tokens')->where('email', $request->email)->delete();

        return redirect()->route('login')->with('success', 'Your password has been reset successfully. Please sign in with your new password.');
    }
}