<?php

namespace App\Http\Controllers\Auth;

use App\Http\Controllers\Controller;
use App\Models\AuditLog;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Hash;
use Illuminate\Support\Str;
use Illuminate\Validation\ValidationException;
use PragmaRX\Google2FA\Google2FA;

class TwoFactorController extends Controller
{
    /**
     * Genera un secreto nuevo (pendiente de confirmar) y el QR para escanear.
     * No queda "activo" hasta que se confirma con un código real (confirm()).
     */
    public function setup(Request $request)
    {
        $user = $request->user();

        abort_if($user->hasTwoFactorEnabled(), 422, __('messages.two_factor_already_enabled'));

        $google2fa = new Google2FA();
        $secret = $google2fa->generateSecretKey();

        $user->forceFill([
            'two_factor_secret' => $secret,
            'two_factor_recovery_codes' => null,
            'two_factor_confirmed_at' => null,
        ])->save();

        return response()->json([
            'secret' => $secret,
            'otpauth_url' => $google2fa->getQRCodeUrl(config('app.name'), $user->email, $secret),
        ]);
    }

    /**
     * Confirma la activación con un código real de la app autenticadora.
     * Recién acá se generan y devuelven los códigos de recuperación (una sola vez).
     */
    public function confirm(Request $request)
    {
        $data = $request->validate([
            'code' => ['required', 'string'],
        ]);

        $user = $request->user();

        abort_if(! $user->two_factor_secret, 422, __('messages.two_factor_not_pending'));

        if (! (new Google2FA())->verifyKey($user->two_factor_secret, $data['code'])) {
            throw ValidationException::withMessages([
                'code' => __('messages.invalid_two_factor_code'),
            ]);
        }

        $recoveryCodes = $this->generateRecoveryCodes();

        $user->forceFill([
            'two_factor_recovery_codes' => $recoveryCodes,
            'two_factor_confirmed_at' => now(),
        ])->save();

        AuditLog::record($request, 'user.2fa_enabled', 'user', $user->id, $user->email);

        return response()->json(['recovery_codes' => $recoveryCodes]);
    }

    public function disable(Request $request)
    {
        $data = $request->validate([
            'password' => ['required', 'string'],
        ]);

        $user = $request->user();

        if (! Hash::check($data['password'], $user->password)) {
            throw ValidationException::withMessages([
                'password' => __('messages.invalid_password'),
            ]);
        }

        $user->forceFill([
            'two_factor_secret' => null,
            'two_factor_recovery_codes' => null,
            'two_factor_confirmed_at' => null,
        ])->save();

        AuditLog::record($request, 'user.2fa_disabled', 'user', $user->id, $user->email);

        return response()->noContent();
    }

    /**
     * Invalida los códigos de recuperación anteriores y genera un juego nuevo
     * (una sola vez más, igual que en la confirmación inicial).
     */
    public function regenerateRecoveryCodes(Request $request)
    {
        $data = $request->validate([
            'password' => ['required', 'string'],
        ]);

        $user = $request->user();

        abort_unless($user->hasTwoFactorEnabled(), 422, __('messages.two_factor_not_enabled'));

        if (! Hash::check($data['password'], $user->password)) {
            throw ValidationException::withMessages([
                'password' => __('messages.invalid_password'),
            ]);
        }

        $recoveryCodes = $this->generateRecoveryCodes();
        $user->forceFill(['two_factor_recovery_codes' => $recoveryCodes])->save();

        AuditLog::record($request, 'user.2fa_recovery_regenerated', 'user', $user->id, $user->email);

        return response()->json(['recovery_codes' => $recoveryCodes]);
    }

    private function generateRecoveryCodes(): array
    {
        return collect(range(1, 8))
            ->map(fn () => Str::upper(Str::random(4).'-'.Str::random(4)))
            ->all();
    }
}