<?php

declare(strict_types=1);

namespace Modules\Helpdesk\Http\Controllers;

use Illuminate\Http\RedirectResponse;
use Illuminate\Http\Request;
use Illuminate\Routing\Controller;
use Illuminate\Support\Facades\DB;
use Illuminate\Support\Str;
use Illuminate\View\View;

final class NativeAuthorizationController extends Controller
{
    public function authorize(Request $request): View
    {
        $data = $this->validateAuthorizationRequest($request);

        return view('helpdesk::native.authorize', [
            'clientId' => $data['client_id'],
            'parameters' => $data,
        ]);
    }

    public function approve(Request $request): RedirectResponse
    {
        $data = $this->validateAuthorizationRequest($request);

        $code = Str::random(64);

        DB::table('helpdesk_native_authorization_codes')->insert([
            'user_id' => $request->user()->getKey(),
            'client_id' => $data['client_id'],
            'code_hash' => hash('sha256', $code),
            'redirect_uri' => $data['redirect_uri'],
            'code_challenge' => $data['code_challenge'],
            'code_challenge_method' => 'S256',
            'expires_at' => now()->addSeconds(
                (int) config('helpdesk-native.authorization_code_lifetime', 60)
            ),
            'created_at' => now(),
            'updated_at' => now(),
        ]);

        $separator = str_contains($data['redirect_uri'], '?') ? '&' : '?';

        return redirect()->away(
            $data['redirect_uri'].$separator.http_build_query([
                'code' => $code,
                'state' => $data['state'],
            ])
        );
    }

    private function validateAuthorizationRequest(Request $request): array
    {
        $data = $request->validate([
            'client_id' => ['required', 'string', 'max:100'],
            'redirect_uri' => ['required', 'string', 'max:2048'],
            'response_type' => ['required', 'in:code'],
            'state' => ['required', 'string', 'min:32', 'max:512'],
            'code_challenge' => [
                'required',
                'string',
                'regex:/^[A-Za-z0-9_-]{43}$/',
            ],
            'code_challenge_method' => ['required', 'in:S256'],
        ]);

        $registeredUris = config(
            'helpdesk-native.clients.'.$data['client_id'].'.redirect_uris',
            []
        );

        abort_unless(
            in_array($data['redirect_uri'], $registeredUris, true),
            400,
            'Unregistered native application callback.'
        );

        return $data;
    }
}