<?php

namespace App\Services\Hosting;

use App\Models\HostingAccount;
use App\Models\HostingAccountMember;
use App\Models\User;
use App\Services\Identity\IdentityClient;
use Illuminate\Support\Collection;
use Illuminate\Support\Facades\Cache;
use Illuminate\Support\Facades\Log;

/**
 * Resolves which hosting accounts a user can access as a developer (shared with
 * them). The monolith is the source of truth; this consolidates the previously
 * inline HostingAccountMember lookups into one place so authz can move to the
 * central identity API.
 *
 * Shadow mode (config hosting.central_dev_access = false, default): local
 * hosting_account_members stays authoritative; central is fetched and any
 * divergence is logged. When flipped to true, central becomes authoritative
 * with a fail-open fallback to local if the API is unreachable.
 */
class HostingAccessResolver
{
    public function __construct(private IdentityClient $identity) {}

    /** @return Collection<int, int> hosting account ids shared with the user */
    public function sharedAccountIds(User $user): Collection
    {
        $local = HostingAccountMember::query()
            ->where('user_id', $user->id)
            ->pluck('hosting_account_id');

        $central = $this->centralAccountIds($user);

        if ($central !== null && $central->sort()->values()->all() !== $local->sort()->values()->all()) {
            Log::warning('Hosting dev-access parity mismatch', [
                'user_id' => $user->id,
                'local' => $local->values()->all(),
                'central' => $central->values()->all(),
            ]);
        }

        if (config('hosting.central_dev_access', false)) {
            return $central ?? $local; // fail-open to local if central unreachable
        }

        return $local;
    }

    /** @return Collection<int, int>|null null = central unreachable (fall back to local) */
    private function centralAccountIds(User $user): ?Collection
    {
        if (! $user->public_id) {
            return collect();
        }

        return Cache::remember(
            "hosting_dev_access:{$user->id}",
            now()->addSeconds(60),
            function () use ($user): ?Collection {
                try {
                    $grants = $this->identity->hostingDeveloperAccess((string) $user->public_id);
                    $usernames = array_values(array_filter(array_map(
                        fn ($g) => $g['username'] ?? null,
                        $grants,
                    )));

                    if ($usernames === []) {
                        return collect();
                    }

                    return HostingAccount::query()
                        ->whereIn('username', $usernames)
                        ->pluck('id');
                } catch (\Throwable $e) {
                    Log::warning('Central hosting dev-access fetch failed', [
                        'user_id' => $user->id,
                        'error' => $e->getMessage(),
                    ]);

                    return null;
                }
            },
        );
    }
}