<?php

namespace App\Http\Controllers\Admin;

use App\Http\Controllers\Controller;
use App\Models\AuditLog;
use App\Models\User;
use Illuminate\Http\RedirectResponse;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Hash;
use Illuminate\Validation\Rule;
use Illuminate\Validation\Rules\Password;
use Illuminate\View\View;

class UserController extends Controller
{
    public function index(): View
    {
        $users = User::with('roles')->orderBy('name')->paginate(25);
        $roles = User::ROLE_LABELS;

        return view('admin.users.index', compact('users', 'roles'));
    }

    public function create(): View
    {
        $roles = User::ROLE_LABELS;

        return view('admin.users.create', compact('roles'));
    }

    public function store(Request $request): RedirectResponse
    {
        $data = $request->validate([
            'name' => ['required', 'string', 'max:255'],
            'email' => ['required', 'email', 'max:255', 'unique:users,email'],
            'role' => ['required', Rule::in(array_keys(User::ROLE_LABELS))],
            'password' => ['required', 'confirmed', Password::min(8)],
        ]);

        $user = User::create([
            'name' => $data['name'],
            'email' => $data['email'],
            'password' => Hash::make($data['password']),
        ]);
        $user->syncRoles([$data['role']]);

        AuditLog::record('user.create', "Cipta pengguna: {$user->name} ({$user->email})", $user, ['role' => $data['role']]);

        return redirect()->route('admin.users.index')->with('success', "Pengguna '{$user->name}' dicipta.");
    }

    public function edit(User $user): View
    {
        $roles = User::ROLE_LABELS;

        return view('admin.users.edit', compact('user', 'roles'));
    }

    public function update(Request $request, User $user): RedirectResponse
    {
        $data = $request->validate([
            'name' => ['required', 'string', 'max:255'],
            'email' => ['required', 'email', 'max:255', Rule::unique('users', 'email')->ignore($user->id)],
            'role' => ['required', Rule::in(array_keys(User::ROLE_LABELS))],
            'password' => ['nullable', 'confirmed', Password::min(8)],
        ]);

        // Jangan biar admin terakhir diturunkan peranannya (boleh kunci sistem)
        if ($this->isLastAdmin($user) && $data['role'] !== User::ROLE_ADMIN) {
            return back()->withInput()->with('error', 'Tidak boleh menukar peranan admin terakhir.');
        }

        $user->update([
            'name' => $data['name'],
            'email' => $data['email'],
        ]);

        if (! empty($data['password'])) {
            $user->update(['password' => Hash::make($data['password'])]);
        }

        $user->syncRoles([$data['role']]);

        AuditLog::record('user.update', "Kemaskini pengguna: {$user->name}", $user, [
            'role' => $data['role'],
            'password_changed' => ! empty($data['password']),
        ]);

        return redirect()->route('admin.users.index')->with('success', 'Maklumat pengguna dikemaskini.');
    }

    public function destroy(Request $request, User $user): RedirectResponse
    {
        if ($user->id === $request->user()->id) {
            return back()->with('error', 'Anda tidak boleh memadam akaun sendiri.');
        }

        if ($this->isLastAdmin($user)) {
            return back()->with('error', 'Tidak boleh memadam admin terakhir.');
        }

        $nama = $user->name;
        $user->delete();
        AuditLog::record('user.delete', "Padam pengguna: {$nama}");

        return redirect()->route('admin.users.index')->with('success', "Pengguna '{$nama}' dipadam.");
    }

    private function isLastAdmin(User $user): bool
    {
        return $user->hasRole(User::ROLE_ADMIN)
            && User::role(User::ROLE_ADMIN)->count() <= 1;
    }
}