<?php

namespace App\Console\Commands;

use App\Services\Ssl\SslRenewalService;
use Illuminate\Console\Command;

class RenewSslCertificatesCommand extends Command
{
    protected $signature = 'ssl:renew
                            {--force : Force renewal even if certificates are not due}
                            {--dry-run : Report how many targets would be processed without making changes}';

    protected $description = 'Renew Let\'s Encrypt SSL certificates for all Ladill-hosted domains';

    public function handle(SslRenewalService $renewalService): int
    {
        $force = (bool) $this->option('force');
        $dryRun = (bool) $this->option('dry-run');

        if ($dryRun) {
            $stats = $renewalService->renewAll($force, true);
            $this->info('SSL renewal dry run:');
            $this->line("  Shared hosting nodes with SSL: {$stats['nodes']}");
            $this->line('  Central web server renewal: ' . ($stats['central'] ? 'yes' : 'no'));
            $this->line("  Managed VPS orders to queue: {$stats['server_orders']}");

            return self::SUCCESS;
        }

        $this->info('Renewing SSL certificates...');
        $stats = $renewalService->renewAll($force, false);

        $this->info("Renewed on {$stats['nodes']} shared hosting node(s).");
        if ($stats['central']) {
            $this->info('Central web server certificates renewed.');
        }
        if ($stats['server_orders'] > 0) {
            $this->info("Queued ssl.renew for {$stats['server_orders']} managed server(s).");
        }
        $this->line("Synced expiry for {$stats['sites_synced']} hosted site(s) and {$stats['domains_synced']} domain record(s).");
        if ($stats['fallbacks'] > 0) {
            $this->warn("Re-issued {$stats['fallbacks']} certificate(s) via fallback provisioning.");
        }

        return self::SUCCESS;
    }
}