<?php

namespace App\Controller\Admin\System\User;

use App\BusProNet\UserDataHandler;
use App\Entity\User;
use App\Htmx\HxRedirectResponse;
use App\Security\Voter\UserVoter;
use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\Routing\Attribute\Route;
use Symfony\Component\Security\Http\Attribute\IsGranted;

/**
 * Granting a privilege is its own act, deliberately not a checkbox on the user edit form:
 * it is confirmed on its own, logged on its own, and cannot happen as a side effect of
 * saving an unrelated setting. It is also the only way a role is ever granted at all -
 * everything else about roles is synced from BusPro (see docs/user-roles.md).
 */
class ApproveRoleController extends AbstractController
{
    public function __construct(private readonly UserDataHandler $userDataHandler)
    {
    }

    #[Route('/admin/system/user/approve-role/{id}/{role}', name: 'app_admin_system_user_approve_role')]
    #[IsGranted(UserVoter::EDIT, subject: 'user')]
    public function index(User $user, string $role, Request $request): Response
    {
        // nothing but a role this user is actually nominated for, so a hand-crafted URL
        // cannot grant one BusPro never claimed
        $pendingRole = User::PENDING_ROLES[$role] ?? null;
        if (null === $pendingRole || false === in_array($pendingRole, $user->getPendingRoles(), true)) {
            throw $this->createNotFoundException('Für diese Rolle liegt keine Freischaltung vor');
        }

        if (true === $request->isMethod(Request::METHOD_POST)) {
            // checked again by the handler, which is what catches a sync revoking the claim
            // between opening the dialog and confirming it
            if (false === $this->userDataHandler->approveRole($user, $role)) {
                throw $this->createNotFoundException('Für diese Rolle liegt keine Freischaltung vor');
            }

            $this->addFlash('success', sprintf('Die Rolle %s wurde freigeschaltet', User::ROLES[$role]));

            return new HxRedirectResponse($this->generateUrl('app_admin_system_user_edit', ['id' => $user->getId()]));
        }

        return $this->render('admin/system/user/modal_approve_role.html.twig', [
            'user' => $user,
            'roleLabel' => User::ROLES[$role],
        ]);
    }
}