<?php

namespace App\Jobs;

use App\Models\Domain;
use App\Models\DomainNsCheck;
use App\Notifications\SslProvisionedNotification;
use App\Services\Ssl\SslProvisioner;
use Illuminate\Bus\Queueable;
use Illuminate\Contracts\Queue\ShouldQueue;
use Illuminate\Foundation\Bus\Dispatchable;
use Illuminate\Queue\InteractsWithQueue;
use Illuminate\Queue\SerializesModels;
use Illuminate\Support\Facades\Log;

class SslProvisioningJob implements ShouldQueue
{
    use Dispatchable, InteractsWithQueue, Queueable, SerializesModels;

    public int $tries = 3;

    public int $backoff = 120;

    public function __construct(public int $domainId)
    {
    }

    public function handle(SslProvisioner $provisioner): void
    {
        $domain = Domain::query()->find($this->domainId);
        if (! $domain) {
            return;
        }

        if ((string) $domain->status !== 'verified' || (string) $domain->onboarding_state !== Domain::STATE_ACTIVE) {
            return;
        }

        if ((string) $domain->ssl_status === 'active') {
            return;
        }

        if (! $provisioner->isConfigured()) {
            Log::info('SslProvisioningJob: Skipped — SSL not configured', ['domain_id' => $domain->id]);

            return;
        }

        $beforeStatus = (string) $domain->status;
        $beforeState = (string) ($domain->onboarding_state ?? '');

        $domain->update(['ssl_status' => 'provisioning']);

        try {
            $certOk = $provisioner->provisionCertificate($domain);
            if (! $certOk) {
                throw new \RuntimeException('certbot failed for ' . $domain->host);
            }

            $nginxOk = $provisioner->generateNginxConfig($domain);
            if (! $nginxOk) {
                throw new \RuntimeException('Nginx config generation failed for ' . $domain->host);
            }

            $reloadOk = $provisioner->reloadNginx();
            if (! $reloadOk) {
                throw new \RuntimeException('Nginx reload failed after provisioning ' . $domain->host);
            }

            $domain->update([
                'ssl_status' => 'active',
                'ssl_provisioned_at' => now(),
                'ssl_expires_at' => now()->addDays(90),
            ]);

            $this->logCheck($domain, 'success', 'SSL certificate provisioned and Nginx configured', $beforeStatus, $beforeState);

            // Notify user that SSL is active
            $user = $domain->website?->user;
            if ($user) {
                $user->notify(new SslProvisionedNotification($domain->fresh()));
            }
        } catch (\Throwable $exception) {
            $domain->update(['ssl_status' => 'failed']);
            $this->logCheck($domain, 'failed', $exception->getMessage(), $beforeStatus, $beforeState);
            Log::error('SslProvisioningJob: Failed', ['domain_id' => $domain->id, 'error' => $exception->getMessage()]);

            throw $exception;
        }
    }

    private function logCheck(Domain $domain, string $result, string $notes, string $statusBefore, string $stateBefore): void
    {
        DomainNsCheck::create([
            'domain_id' => $domain->id,
            'check_type' => 'ssl_provision',
            'result' => $result,
            'notes' => $notes,
            'status_before' => $statusBefore,
            'status_after' => (string) $domain->status,
            'state_before' => $stateBefore,
            'state_after' => (string) ($domain->onboarding_state ?? ''),
            'checked_at' => now(),
        ]);
    }
}