<?php

namespace App\Http\Controllers\Auth;

use App\Http\Controllers\Controller;
use Illuminate\Http\RedirectResponse;
use Illuminate\Support\Facades\Auth;
use Illuminate\Validation\ValidationException;
use Inertia\Inertia;
use Inertia\Response;
use Laravel\Fortify\Events\TwoFactorAuthenticationFailed;
use Laravel\Fortify\Events\ValidTwoFactorAuthenticationCodeProvided;
use Laravel\Fortify\Http\Requests\TwoFactorLoginRequest;

class TwoFactorChallengeController extends Controller
{
    /**
     * Display the two-factor challenge.
     */
    public function create(TwoFactorLoginRequest $request): Response|RedirectResponse
    {
        if (! config('auth-ui.features.two_factor') || ! $request->hasChallengedUser()) {
            $this->clearChallenge($request);

            return redirect()->route('login');
        }

        return Inertia::render('Auth/TwoFactorChallenge');
    }

    /**
     * Complete the pending login using a TOTP or recovery code.
     */
    public function store(TwoFactorLoginRequest $request): RedirectResponse
    {
        if (! config('auth-ui.features.two_factor') || ! $request->hasChallengedUser()) {
            $this->clearChallenge($request);

            return redirect()->route('login');
        }

        $user = $request->challengedUser();

        if (! $user->hasEnabledTwoFactorAuthentication()) {
            $this->clearChallenge($request);

            return redirect()->route('login');
        }

        if ($recoveryCode = $request->validRecoveryCode()) {
            $user->replaceRecoveryCode($recoveryCode);
        } elseif (! $request->hasValidCode()) {
            event(new TwoFactorAuthenticationFailed($user));

            throw ValidationException::withMessages([
                $request->filled('recovery_code') ? 'recovery_code' : 'code' => 'The provided authentication code was invalid.',
            ]);
        }

        event(new ValidTwoFactorAuthenticationCodeProvided($user));

        Auth::login($user, $request->remember());
        $request->session()->regenerate();

        return redirect()->intended(config('auth-ui.redirects.login', '/dashboard'));
    }

    private function clearChallenge(TwoFactorLoginRequest $request): void
    {
        $request->session()->forget(['login.id', 'login.remember']);
    }
}