<?php

declare(strict_types=1);

namespace App\Actions\Auth;

use App\Auth\PireonTokenGuard;
use App\Models\User;
use Illuminate\Support\Facades\DB;
use Illuminate\Support\Facades\Log;

/**
 * What a Pireon webhook changes here.
 *
 * - `user.deactivated`: the account goes inactive (which also stops its
 *   machine tokens and the panel), its panel sessions end and its cached
 *   bearer tokens are forgotten. Signing in again once Pireon reactivates it
 *   turns it back on, as every sign-in copies the upstream state.
 * - `token.revoked`: only token hashes are cached, so every cached token and
 *   panel session of that person goes; they sign in again.
 *
 * Anything else, or a person who never signed in here, is ignored. Repeating
 * a delivery (one arrives per registered client) changes nothing.
 */
class HandlePireonWebhook
{
    public const EVENTS = ['user.deactivated', 'token.revoked'];

    /**
     * @param  array<string, mixed>  $data
     */
    public function handle(string $event, array $data): void
    {
        if (! in_array($event, self::EVENTS, true)) {
            Log::debug('Unhandled Pireon webhook', ['event' => $event]);

            return;
        }

        $oauthId = $data['user_id'] ?? $data['userId'] ?? ($data['user']['id'] ?? null);

        if ($oauthId === null || $oauthId === '') {
            Log::warning('Pireon webhook without a user id, ignored', ['event' => $event]);

            return;
        }

        PireonTokenGuard::forgetUser((string) $oauthId);

        $user = User::query()->where('oauth_id', $oauthId)->first();

        if ($user === null) {
            return;
        }

        if ($event === 'user.deactivated' && $user->is_active) {
            $user->forceFill(['is_active' => false])->save();
        }

        $this->endSessions($user);
    }

    /**
     * Sessions kept in the database can be ended one person at a time. With
     * any other driver they cannot, but an inactive account is still turned
     * away on its next request (canAccessPanel).
     */
    protected function endSessions(User $user): void
    {
        if (config('session.driver') !== 'database') {
            return;
        }

        DB::connection(config('session.connection'))
            ->table((string) config('session.table', 'sessions'))
            ->where('user_id', $user->getKey())
            ->delete();
    }
}