<?php

namespace App\Http\Controllers;

use App\Http\Requests\Profile\UpdatePasswordRequest;
use App\Models\User;
use App\Notifications\PasswordChangedNotification;
use App\Services\Auth\SecurityEventRecorder;
use App\Services\Auth\TwoFactorEnrollmentState;
use Illuminate\Http\RedirectResponse;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\DB;
use Illuminate\Support\Str;
use Inertia\Inertia;
use Inertia\Response;

class ProfileSecurityController extends Controller
{
    /**
     * Display the authenticated user's security settings.
     */
    public function show(
        Request $request,
        TwoFactorEnrollmentState $enrollmentState
    ): Response {
        /** @var User $user */
        $user = $request->user();

        return Inertia::render('Profile/Security', [
            'twoFactor' => $enrollmentState->for($user),
        ]);
    }

    /**
     * Update the authenticated user's password and revoke other sessions.
     */
    public function updatePassword(
        UpdatePasswordRequest $request,
        SecurityEventRecorder $securityEvents
    ): RedirectResponse {
        /** @var User $user */
        $user = $request->user();

        $user->forceFill([
            'password' => $request->validated('password'),
            'remember_token' => Str::random(60),
            'auth_session_version' => $user->auth_session_version + 1,
        ])->save();

        if (config('session.driver') === 'database') {
            DB::table(config('session.table'))
                ->where('user_id', $user->getKey())
                ->where('id', '!=', $request->session()->getId())
                ->delete();
        }

        $request->session()->put(
            'auth.session_version',
            $user->auth_session_version
        );

        $user->notify(new PasswordChangedNotification(
            (string) $request->ip(),
            now()->toIso8601String()
        ));
        $securityEvents->record('password.changed', $user, $request);

        return redirect()->route('profile.security')
            ->with('success', 'Your password has been updated. Other sessions were signed out.');
    }
}