<?php

namespace App\Http\Controllers\Api;

use App\Http\Controllers\Controller;
use App\Models\User;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Hash;

class AuthController extends Controller
{
    // POST /api/register
    public function register(Request $request)
    {
        $validated = $request->validate([
            'name'       => 'required|string|max:255',
            'username'   => 'required|string|max:255|unique:users,username',
            'password'   => 'required|string|min:6|confirmed',
            'role'       => 'required|string|max:255',
            'department' => 'required|string|max:255',
            'phone'      => 'required|string|max:20|unique:users,phone',
        ]);

        $validated['password'] = Hash::make($validated['password']);
        $user = User::create($validated);

        return response()->json([
            'message' => 'একাউন্ট তৈরি হয়েছে',
            'user' => $user->only(['id', 'name', 'username', 'role', 'department']),
        ], 201);
    }

    // POST /api/login
    public function login(Request $request)
    {
        $request->validate([
            'username' => 'required|string',
            'password' => 'required|string',
        ]);

        $user = User::where('username', $request->username)->first();

        if (! $user || ! Hash::check($request->password, $user->password)) {
            return response()->json(['message' => 'ইউজারনেম বা পাসওয়ার্ড ভুল'], 401);
        }

        $token = $user->createToken('auth_token')->plainTextToken;

        return response()->json([
            'token' => $token,
            'user' => $user->only(['id', 'name', 'username', 'role', 'department']),
        ]);
    }

    // GET /api/me
    public function me(Request $request)
    {
        return response()->json([
            'user' => $request->user()->only(['name', 'role', 'department']),
        ]);
    }

    // POST /api/logout
    public function logout(Request $request)
    {
        $request->user()->currentAccessToken()->delete();

        return response()->json(['message' => 'লগআউট সফল হয়েছে']);
    }

    // POST /api/password/forgot  -> মাস্ক করা ফোন নম্বর ফেরত দেয়
    public function forgotPasswordFind(Request $request)
    {
        $request->validate(['username' => 'required|string']);

        $user = User::where('username', $request->username)->first();

        if (! $user) {
            return response()->json(['message' => 'এই আইডিতে কোনো একাউন্ট পাওয়া যায়নি'], 404);
        }

        $phone = $user->phone;
        $masked = str_repeat('*', max(strlen($phone) - 3, 0)) . substr($phone, -3);

        return response()->json(['masked_phone' => $masked]);
    }

    // POST /api/password/reset -> ফোন নম্বর যাচাই করে পাসওয়ার্ড বদলায়
    public function resetPassword(Request $request)
    {
        $request->validate([
            'username' => 'required|string',
            'phone'    => 'required|string',
            'password' => 'required|string|min:6|confirmed',
        ]);

        $user = User::where('username', $request->username)->first();

        if (! $user || $user->phone !== $request->phone) {
            return response()->json(['message' => 'ফোন নম্বরটি মিলছে না'], 422);
        }

        $user->password = Hash::make($request->password);
        $user->save();

        return response()->json(['message' => 'পাসওয়ার্ড পরিবর্তন হয়েছে']);
    }
}