<?php

namespace App\Http\Controllers;

use App\Models\AdminUser;
use App\Services\AdminUserManagementService;
use Illuminate\Http\Request;
use Illuminate\Validation\Rule;

class AdminUserManagementController extends Controller
{
    public function __construct(private AdminUserManagementService $service) {}

    public function index(Request $request)
    {
        $this->authorizeSystemAdmin($request);

        return view('admin.admin-users', $this->service->index($request->only('q', 'status')));
    }

    public function store(Request $request)
    {
        $this->authorizeSystemAdmin($request);
        $this->service->create($request->validate([
            'name' => ['required', 'string', 'max:150'],
            'email' => ['required', 'email', 'max:255', Rule::unique('admin_users', 'email')],
            'role' => ['required', Rule::in(['System Admin', 'Admin'])],
        ]));

        return back()->with('success', 'Administrator account created. A temporary password was sent by email.');
    }

    public function update(Request $request, AdminUser $adminUser)
    {
        $this->authorizeSystemAdmin($request);
        $data = $request->validate(['status' => ['required', Rule::in(['active', 'inactive', 'deactivated'])]]);

        if ($adminUser->is($request->user()) && $data['status'] !== 'active') {
            return back()->withErrors(['status' => 'You cannot deactivate your own administrator account.']);
        }
        if ($adminUser->isSystemAdmin() && $data['status'] !== 'active' && $this->service->activeSystemAdminsExcept($adminUser) === 0) {
            return back()->withErrors(['status' => 'At least one active System Admin account is required.']);
        }

        $this->service->update($adminUser, $data);

        return back()->with('success', 'Administrator access updated.');
    }

    private function authorizeSystemAdmin(Request $request): void
    {
        abort_unless($request->user()?->isSystemAdmin(), 403, 'Only System Admin accounts can manage administrators.');
    }
}