<?php

namespace App\Controller\Security;

use App\Security\OAuth2\MyEpClient;
use Flagception\Manager\FeatureManagerInterface;
use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\Routing\Attribute\Route;

class OAuth2Controller extends AbstractController
{
    public function __construct(
        private readonly MyEpClient $client,
        private readonly FeatureManagerInterface $featureManager,
    ) {
    }

    #[Route('/myep-auth/init', name: 'app_myep_auth_init')]
    public function init(Request $request): Response
    {
        $this->denyUnlessFeatureIsActive();

        $provider = $this->client->getProvider();
        $url = $provider->getAuthorizationUrl();
        $state = $provider->getState();
        $request->getSession()->set('oauth2state', $state);

        return $this->redirect($url);
    }

    #[Route('/myep-auth/check', name: 'app_myep_auth_check')]
    public function check(): void
    {
        // only reached when the authenticator did not handle the request, which with the
        // feature switched off it never does
        $this->denyUnlessFeatureIsActive();
    }

    /**
     * The login is not merely hidden while the feature is off: the callback creates and
     * updates local accounts, so the routes must not be reachable by direct URL either.
     */
    private function denyUnlessFeatureIsActive(): void
    {
        if (false === $this->featureManager->isActive('myep_login')) {
            throw $this->createNotFoundException();
        }
    }
}