<?php

declare(strict_types=1);

namespace App\Console\Commands;

use App\Models\User;
use Illuminate\Console\Command;
use Spatie\Permission\Models\Role;

use function Laravel\Prompts\select;

/**
 * Bootstraps administration.
 *
 * Local accounts only appear after their first OAuth login, so there is no
 * super admin to promote anyone at install time. This command is the way in:
 * sign in once through the panel, then run
 *
 *   php artisan user:role you@example.com super_admin
 */
class AssignRole extends Command
{
    protected $signature = 'user:role {email : Email of the user, as known to the identity server}
                                      {role? : Role to grant; prompts when omitted}
                                      {--revoke : Remove the role instead of granting it}
                                      {--only : Replace all of the user\'s roles with this one}';

    protected $description = 'Grant or revoke a local role for a user';

    public function handle(): int
    {
        $user = User::query()->where('email', $this->argument('email'))->first();

        if (! $user) {
            $this->error("No local user with email [{$this->argument('email')}].");
            $this->line('Local accounts are created on first login. Ask them to sign in once, then re-run this.');

            return self::FAILURE;
        }

        $role = $this->argument('role') ?? select(
            label: 'Which role?',
            options: Role::query()->pluck('name', 'name')->all(),
        );

        if (! Role::query()->where('name', $role)->exists()) {
            $this->error("No role named [{$role}]. Run `php artisan permissions:sync` first.");

            return self::FAILURE;
        }

        match (true) {
            (bool) $this->option('revoke') => $user->removeRole($role),
            (bool) $this->option('only') => $user->syncRoles([$role]),
            default => $user->assignRole($role),
        };

        $this->info(sprintf(
            '%s now has roles: %s',
            $user->email,
            $user->fresh()->roles->pluck('name')->implode(', ') ?: '(none)',
        ));

        return self::SUCCESS;
    }
}