<?php

namespace App\Http\Controllers\Api;

use App\Http\Controllers\Controller;
use App\Models\AuditLog;
use App\Models\User;
use App\Support\UserSessions;
use Illuminate\Http\Request;
use Illuminate\Routing\Controllers\HasMiddleware;
use Illuminate\Routing\Controllers\Middleware;
use Laravel\Passport\Http\Middleware\CheckToken;
use OpenApi\Attributes as OA;

class UserSessionController extends Controller implements HasMiddleware
{
    public static function middleware(): array
    {
        return [
            new Middleware(CheckToken::using('users:read'), only: ['index']),
            new Middleware(CheckToken::using('users:write'), only: ['destroy', 'destroyAll']),
        ];
    }

    #[OA\Get(
        path: '/users/{user}/sessions',
        summary: 'Tokens OAuth activos de un usuario ("sesiones")',
        description: 'Requiere el permiso users.view (o un token client_credentials, servicio de confianza).',
        security: [['oauth2' => ['users:read']]],
        tags: ['Users'],
        parameters: [new OA\Parameter(name: 'user', in: 'path', required: true, schema: new OA\Schema(type: 'integer'))],
        responses: [
            new OA\Response(response: 200, description: 'Listado de tokens activos'),
            new OA\Response(response: 403, description: 'Sin permiso users.view'),
        ]
    )]
    public function index(Request $request, User $user)
    {
        $actor = $request->user('api');
        abort_if($actor && ! $actor->can('users.view'), 403);

        return response()->json(UserSessions::active($user));
    }

    #[OA\Delete(
        path: '/users/{user}/sessions/{tokenId}',
        summary: 'Revocar un token OAuth activo de un usuario',
        description: 'Requiere el permiso users.update (o un token client_credentials, servicio de confianza).',
        security: [['oauth2' => ['users:write']]],
        tags: ['Users'],
        parameters: [
            new OA\Parameter(name: 'user', in: 'path', required: true, schema: new OA\Schema(type: 'integer')),
            new OA\Parameter(name: 'tokenId', in: 'path', required: true, schema: new OA\Schema(type: 'string')),
        ],
        responses: [
            new OA\Response(response: 204, description: 'Token revocado'),
            new OA\Response(response: 403, description: 'Sin permiso users.update'),
            new OA\Response(response: 404, description: 'El token no existe o no pertenece a ese usuario'),
        ]
    )]
    public function destroy(Request $request, User $user, string $tokenId)
    {
        $actor = $request->user('api');
        abort_if($actor && ! $actor->can('users.update'), 403);

        abort_unless(UserSessions::revoke($user, $tokenId), 404);

        AuditLog::record($request, 'user.session_revoked', 'user', $user->id, $user->email);

        return response()->noContent();
    }

    #[OA\Delete(
        path: '/users/{user}/sessions',
        summary: 'Revocar todos los tokens OAuth activos de un usuario',
        description: 'Requiere el permiso users.update (o un token client_credentials, servicio de confianza).',
        security: [['oauth2' => ['users:write']]],
        tags: ['Users'],
        parameters: [new OA\Parameter(name: 'user', in: 'path', required: true, schema: new OA\Schema(type: 'integer'))],
        responses: [
            new OA\Response(response: 204, description: 'Todos los tokens revocados'),
            new OA\Response(response: 403, description: 'Sin permiso users.update'),
        ]
    )]
    public function destroyAll(Request $request, User $user)
    {
        $actor = $request->user('api');
        abort_if($actor && ! $actor->can('users.update'), 403);

        $count = UserSessions::revokeAll($user);

        AuditLog::record($request, 'user.sessions_revoked_all', 'user', $user->id, $user->email, [
            'count' => $count,
        ]);

        return response()->noContent();
    }
}