<?php

declare(strict_types=1);

namespace App\Actions\Auth;

use App\Models\User;
use App\Services\Pireon\PireonIdentity;
use Illuminate\Support\Facades\DB;
use Spatie\Permission\Models\Role;

/**
 * Mirror an identity from the OAuth server into the local users table.
 *
 * Identity fields are overwritten on every login — the identity server is the
 * source of truth for who someone is. Local roles are never touched here: this
 * application owns authorisation, so a role granted in the panel survives every
 * subsequent login, and `app_roles` reported upstream grant nothing.
 */
class SyncPireonUser
{
    public function handle(PireonIdentity $identity): User
    {
        return DB::transaction(function () use ($identity): User {
            $user = User::query()
                ->where('oauth_id', $identity->id)
                ->first();

            // Adopt a pre-existing local account created by a seeder or an
            // earlier import, so the first real login claims it instead of
            // colliding with the unique email index.
            $user ??= User::query()
                ->whereNull('oauth_id')
                ->where('email', $identity->email)
                ->first();

            $isNew = $user === null;
            $user ??= new User;

            $user->fill([
                'oauth_id' => $identity->id,
                'name' => $identity->name,
                'email' => $identity->email,
                'is_active' => $identity->isActive,
                'remote_roles' => $identity->roles,
                'last_login_at' => now(),
            ]);

            // The upstream account is already verified by the identity server;
            // recording it here keeps Laravel's own checks satisfied.
            $user->email_verified_at ??= now();

            $user->save();

            if ($isNew) {
                $this->assignDefaultRole($user);
            }

            return $user->refresh();
        });
    }

    /**
     * A brand new identity gets the least-privileged role. Promoting them is a
     * deliberate act performed by an administrator in the panel.
     */
    protected function assignDefaultRole(User $user): void
    {
        $role = (string) config('pireon.default_role');

        if (blank($role) || $user->roles()->exists()) {
            return;
        }

        // Silently skip when the role has not been seeded yet, so a login can
        // never fail because of a missing local role.
        if (Role::where('name', $role)->exists()) {
            $user->assignRole($role);
        }
    }
}