<?php

namespace App\Http\Controllers\Hosting;

use App\Http\Controllers\Controller;
use App\Models\HostingTeamMember;
use App\Models\User;
use Illuminate\Http\RedirectResponse;
use Illuminate\Http\Request;
use Illuminate\Support\Str;
use Illuminate\View\View;

/**
 * Ladill Email — Team. Invite teammates to an account and manage their roles;
 * members can then manage that account's mailboxes & domains. Members accept by
 * signing into Email with the invited email (SSO). Owner and admins can manage.
 */
class TeamController extends Controller
{
    public function index(Request $request): View
    {
        $account = ladill_account();

        $members = HostingTeamMember::query()
            ->where('account_id', $account->id)
            ->with('member')
            ->orderBy('status')->orderBy('email')
            ->get();

        return view('hosting.account.team', [
            'account' => $account,
            'members' => $members,
            'canManage' => $this->canManage($request),
            'isOwner' => $request->user()->id === $account->id,
        ]);
    }

    public function store(Request $request): RedirectResponse
    {
        abort_unless($this->canManage($request), 403);

        $validated = $request->validate([
            'email' => ['required', 'email', 'max:255'],
            'role' => ['required', 'in:admin,member'],
        ]);

        $account = ladill_account();
        $email = strtolower($validated['email']);

        if ($email === strtolower($account->email)) {
            return back()->withErrors(['email' => 'The owner is already on the account.']);
        }

        $member = HostingTeamMember::firstOrNew(['account_id' => $account->id, 'email' => $email]);
        $member->role = $validated['role'];
        if (! $member->exists) {
            $member->status = HostingTeamMember::STATUS_INVITED;
            $member->token = Str::random(40);
        }
        $member->save();

        if ($existing = User::whereRaw('LOWER(email) = ?', [$email])->first()) {
            HostingTeamMember::linkPendingInvitesFor($existing);
        }

        return back()->with('success', $email.' invited.');
    }

    public function updateRole(Request $request, HostingTeamMember $member): RedirectResponse
    {
        abort_unless($this->canManage($request) && $member->account_id === ladill_account()->id, 403);

        $validated = $request->validate(['role' => ['required', 'in:admin,member']]);
        $member->update(['role' => $validated['role']]);

        return back()->with('success', 'Role updated.');
    }

    public function destroy(Request $request, HostingTeamMember $member): RedirectResponse
    {
        abort_unless($this->canManage($request) && $member->account_id === ladill_account()->id, 403);

        $member->delete();

        return back()->with('success', 'Member removed.');
    }

    /** Switch the acting account (own, or one you're a member of). */
    public function switchAccount(Request $request): RedirectResponse
    {
        $validated = $request->validate(['account' => ['required', 'integer']]);

        abort_unless($request->user()->canAccessAccount((int) $validated['account']), 403);

        $request->session()->put('ladill_account', (int) $validated['account']);

        return redirect()->route('servers.dashboard');
    }

    private function canManage(Request $request): bool
    {
        $user = $request->user();
        $account = ladill_account();

        if ($user->id === $account->id) {
            return true; // owner
        }

        return $user->memberships()
            ->where('account_id', $account->id)
            ->where('role', HostingTeamMember::ROLE_ADMIN)
            ->exists();
    }
}