<?php

namespace App\Http\Controllers;

use App\Models\TenantSetupToken;
use App\Models\Inquiry;
use App\Models\User;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Hash;
use Illuminate\Support\Facades\RateLimiter;
use Inertia\Inertia;
use Inertia\Response;
use Illuminate\Http\RedirectResponse;

class TenantSetupController extends Controller
{
    /**
     * Display the one-time admin setup form.
     */
    public function showSetupForm(Request $request): Response|RedirectResponse
    {
        $rawToken = $request->query('token');
        if (!$rawToken) {
            return redirect()->route('login')->with('error', 'Invalid setup link.');
        }

        $tokenHash = hash('sha256', $rawToken);
        $setupToken = TenantSetupToken::where('token_hash', $tokenHash)->first();

        if (!$setupToken || $setupToken->isUsed() || $setupToken->isExpired()) {
            return redirect()->route('login')->with('error', 'This setup link is invalid, used, or has expired.');
        }

        return Inertia::render('auth/setup-admin', [
            'token' => $rawToken,
            'email' => $setupToken->email,
        ]);
    }

    /**
     * Handle the password set request for admin setup.
     */
    public function completeSetup(Request $request): RedirectResponse
    {
        // Rate-limit setup attempts
        $throttleKey = 'tenant-setup:' . $request->ip();
        if (RateLimiter::tooManyAttempts($throttleKey, 5)) {
            return back()->withErrors(['password' => 'Too many setup attempts. Please try again later.']);
        }
        RateLimiter::hit($throttleKey, 60);

        $request->validate([
            'token' => 'required|string',
            'password' => 'required|string|min:8|confirmed',
        ]);

        $tokenHash = hash('sha256', $request->token);
        $setupToken = TenantSetupToken::where('token_hash', $tokenHash)->first();

        if (!$setupToken || $setupToken->isUsed() || $setupToken->isExpired()) {
            return redirect()->route('login')->with('error', 'This setup link is invalid, used, or has expired.');
        }

        // Update admin user inside active tenant context or find by email
        $user = User::where('email', $setupToken->email)->first();
        if (!$user) {
            return back()->withErrors(['password' => 'Administrator account not found.']);
        }

        $user->update([
            'password' => Hash::make($request->password),
            'status' => 'active',
            'is_enable_login' => 1,
            'email_verified_at' => now(),
        ]);

        // Mark token as used
        $setupToken->update([
            'used_at' => now(),
        ]);

        // Update inquiry status to activated if exists
        $inquiry = Inquiry::on('sqlite')->where('email', $setupToken->email)->first();
        if ($inquiry) {
            $inquiry->update(['status' => 'activated']);
        }

        RateLimiter::clear($throttleKey);

        return redirect()->route('login')->with('success', 'Your administrator account has been activated successfully! You may now log in.');
    }
}