<?php

namespace App\Http\Controllers\Api\V1;

use App\Http\Controllers\Api\Concerns\RespondsWithJson;
use App\Http\Controllers\Controller;
use App\Services\LdapAuthService;
use App\Services\LdapMetadataService;
use App\Services\LdapUserService;
use App\Services\MailDeliveryService;
use App\Support\ApiActor;
use Illuminate\Http\JsonResponse;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Storage;
use Illuminate\Support\Str;
use InvalidArgumentException;
use RuntimeException;
use Throwable;

class MeController extends Controller
{
    use RespondsWithJson;

    public function __construct(
        private readonly LdapAuthService $ldapAuth,
        private readonly LdapMetadataService $metadata,
        private readonly LdapUserService $ldapUsers,
        private readonly MailDeliveryService $mailDelivery,
    ) {
    }

    public function show(Request $request): JsonResponse
    {
        /** @var ApiActor $actor */
        $actor = $request->attributes->get('api_actor');

        $data = $actor->toArray();

        if ($actor->type === 'ldap_jwt') {
            $profile = $this->ldapAuth->getProfile($actor->identifier);
            $meta    = $this->metadata->getUserMeta($actor->identifier);

            $data['display_name'] = $profile['display_name'] ?? $actor->identifier;
            $data['email']        = $profile['email'] ?? '';
            $data['last_logon']   = $profile['last_logon'] ?? null;
            $data['domain']       = $profile['domain'] ?? '';
            $data['phone']        = $meta['phone'] ?? '';
            $data['other_email']  = $meta['other_email'] ?? '';
            $avatarPath           = $meta['avatar'] ?? null;
            $data['avatar']       = $avatarPath
                ? Storage::disk('oss')->url($avatarPath)
                : null;
        }

        return $this->ok($data);
    }

    public function update(Request $request): JsonResponse
    {
        /** @var ApiActor $actor */
        $actor = $request->attributes->get('api_actor');

        if ($actor->type !== 'ldap_jwt') {
            return $this->fail('Hanya akun LDAP yang dapat mengubah profil.', 'forbidden', 403);
        }

        $data = $request->validate([
            'display_name' => ['required', 'string', 'max:255'],
            'email'        => ['nullable', 'email', 'max:255'],
            'other_email'  => ['nullable', 'email', 'max:255'],
            'phone'        => ['nullable', 'string', 'max:32'],
        ]);

        try {
            $this->ldapUsers->updateProfile(
                $actor->identifier,
                $data['display_name'],
                $data['email'] ?? null
            );
            $this->metadata->saveUserSelfMeta(
                $actor->identifier,
                $data['other_email'] ?? null,
                $data['phone'] ?? null
            );
        } catch (InvalidArgumentException|RuntimeException $e) {
            return $this->fail($e->getMessage(), 'unprocessable', 422);
        } catch (Throwable) {
            return $this->fail('Gagal memperbarui profil.', 'server_error', 500);
        }

        return $this->ok(['message' => 'Profil berhasil diperbarui.']);
    }

    public function changePassword(Request $request): JsonResponse
    {
        /** @var ApiActor $actor */
        $actor = $request->attributes->get('api_actor');

        if ($actor->type !== 'ldap_jwt') {
            return $this->fail('Hanya akun LDAP yang dapat mengubah password.', 'forbidden', 403);
        }

        $data = $request->validate([
            'current_password' => ['required', 'string'],
            'new_password'     => ['required', 'string', 'min:8', 'confirmed'],
        ]);

        $verified = $this->ldapAuth->attempt($actor->identifier, $data['current_password']);
        if ($verified === null) {
            return $this->fail('Password saat ini tidak sesuai.', 'invalid_credentials', 422);
        }

        try {
            $this->ldapUsers->resetPassword($actor->identifier, $data['new_password']);
        } catch (InvalidArgumentException|RuntimeException $e) {
            return $this->fail($e->getMessage(), 'unprocessable', 422);
        } catch (Throwable) {
            return $this->fail('Gagal mengubah password. Pastikan password memenuhi kebijakan AD.', 'server_error', 500);
        }

        return $this->ok(['message' => 'Password berhasil diubah.']);
    }

    public function updateAvatar(Request $request): JsonResponse
    {
        /** @var ApiActor $actor */
        $actor = $request->attributes->get('api_actor');

        if ($actor->type !== 'ldap_jwt') {
            return $this->fail('Hanya akun LDAP yang dapat mengubah avatar.', 'forbidden', 403);
        }

        $data = $request->validate([
            'avatar' => ['nullable', 'string', 'max:524288'],
        ]);

        try {
            $meta        = $this->metadata->getUserMeta($actor->identifier);
            $oldPath     = $meta['avatar'] ?? null;
            $avatarInput = isset($data['avatar']) && $data['avatar'] !== '' ? $data['avatar'] : null;

            if ($avatarInput === null) {
                // Hapus foto
                if ($oldPath) {
                    Storage::disk('oss')->delete($oldPath);
                }
                $this->metadata->saveAvatar($actor->identifier, null);
                return $this->ok(['message' => 'Foto profil dihapus.', 'avatar_url' => null]);
            }

            // Validasi format base64 data-URI
            if (! preg_match('/^data:image\/(jpeg|png|webp);base64,(.+)$/s', $avatarInput, $m)) {
                return $this->fail('Format avatar tidak valid. Harus base64 image (jpeg/png/webp).', 'invalid_format', 422);
            }

            $imageData = base64_decode($m[2], strict: true);
            if ($imageData === false || strlen($imageData) > 300 * 1024) {
                return $this->fail('Ukuran gambar terlalu besar (maks 300KB).', 'too_large', 422);
            }

            $ext      = $m[1] === 'jpeg' ? 'jpg' : $m[1];
            $filename = 'avatars/' . Str::slug($actor->identifier) . '-' . Str::random(8) . '.' . $ext;

            Storage::disk('oss')->put($filename, $imageData, 'public');

            // Hapus file lama jika ada
            if ($oldPath && $oldPath !== $filename) {
                Storage::disk('oss')->delete($oldPath);
            }

            $this->metadata->saveAvatar($actor->identifier, $filename);

            $avatarUrl = Storage::disk('oss')->url($filename);
        } catch (Throwable $e) {
            return $this->fail('Gagal menyimpan avatar: ' . $e->getMessage(), 'server_error', 500);
        }

        return $this->ok(['message' => 'Foto profil berhasil diperbarui.', 'avatar_url' => $avatarUrl]);
    }

    public function testEmail(Request $request): JsonResponse
    {
        /** @var ApiActor $actor */
        $actor = $request->attributes->get('api_actor');

        if ($actor->type !== 'ldap_jwt') {
            return $this->fail('Hanya akun LDAP yang dapat mengirim test email.', 'forbidden', 403);
        }

        $profile = $this->ldapAuth->getProfile($actor->identifier);
        $meta    = $this->metadata->getUserMeta($actor->identifier);

        $recipients = array_values(array_filter([
            ($profile['email'] ?? '') !== '' ? $profile['email'] : null,
            ($meta['other_email'] ?? '') !== '' ? $meta['other_email'] : null,
        ]));

        if ($recipients === []) {
            return $this->fail('Tidak ada alamat email tersimpan. Tambahkan email di profil terlebih dahulu.', 'no_email', 422);
        }

        try {
            $sent = $this->mailDelivery->sendTestToMany($recipients);
        } catch (Throwable) {
            return $this->fail('Gagal mengirim email. Periksa konfigurasi SMTP.', 'smtp_error', 500);
        }

        return $this->ok(['message' => 'Test email terkirim ke: ' . implode(', ', $sent) . '.', 'sent_to' => $sent]);
    }
}