<?php

declare(strict_types=1);

namespace App\Controller;

use App\Security\OAuth2\EpClient;
use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
use Symfony\Component\HttpFoundation\RedirectResponse;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\Routing\Attribute\Route;

final class SecurityController extends AbstractController
{
    public function __construct(private readonly EpClient $client)
    {
    }

    #[Route('/login', name: 'app_login', methods: ['GET'])]
    public function login(): Response
    {
        if ($this->getUser()) {
            return $this->redirectToRoute('app_dashboard');
        }

        return $this->render('security/login.html.twig', [
            'oauth2_configured' => $this->client->isConfigured(),
        ]);
    }

    /**
     * Starts the authorization code flow: stores the state on the session and sends the browser
     * to myep.
     */
    #[Route('/auth/init', name: 'app_auth_init', methods: ['GET'])]
    public function authInit(Request $request): Response
    {
        if (!$this->client->isConfigured()) {
            $this->addFlash('error', 'Für ephub ist auf myep noch kein OAuth2-Client registriert.');

            return $this->redirectToRoute('app_login');
        }

        return new RedirectResponse($this->client->authorizationUrl($request));
    }

    /**
     * The registered callback URL. Never executed: EpAuthenticator::supports() matches this
     * route and the firewall handles the request before it reaches a controller. The route has
     * to exist all the same, because the redirect URI is generated from it.
     */
    #[Route('/auth/check', name: 'app_auth_check', methods: ['GET'])]
    public function authCheck(): never
    {
        throw new \LogicException('Intercepted by EpAuthenticator on the main firewall.');
    }

    /**
     * Never executed: the firewall's logout listener intercepts this route.
     */
    #[Route('/logout', name: 'app_logout', methods: ['GET'])]
    public function logout(): never
    {
        throw new \LogicException('Intercepted by the logout key on the main firewall.');
    }
}