<?php

namespace App\BusProNet\Security;

use App\BusProNet\ApiClient;
use App\BusProNet\Exception\ApiClientException;
use App\BusProNet\Model\CrmAttributes;
use App\BusProNet\Model\PersonalData;
use Psr\Log\LoggerInterface;
use Symfony\Component\HttpFoundation\RedirectResponse;
use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\Routing\Generator\UrlGeneratorInterface;
use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
use Symfony\Component\Security\Core\Exception\CustomUserMessageAuthenticationException;
use Symfony\Component\Security\Http\Authenticator\AbstractLoginFormAuthenticator;
use Symfony\Component\Security\Http\Authenticator\Passport\Badge\CsrfTokenBadge;
use Symfony\Component\Security\Http\Authenticator\Passport\Badge\RememberMeBadge;
use Symfony\Component\Security\Http\Authenticator\Passport\Badge\UserBadge;
use Symfony\Component\Security\Http\Authenticator\Passport\Passport;
use Symfony\Component\Security\Http\Authenticator\Passport\SelfValidatingPassport;
use Symfony\Component\Security\Http\EntryPoint\AuthenticationEntryPointInterface;

class Authenticator extends AbstractLoginFormAuthenticator implements AuthenticationEntryPointInterface
{
    public function __construct(
        private readonly UrlGeneratorInterface $urlGenerator,
        private readonly ApiClient $apiClient,
        private readonly LoggerInterface $logger,
    ) {
    }

    protected function getLoginUrl(Request $request): string
    {
        return $this->urlGenerator->generate('app_login');
    }

    public function authenticate(Request $request): Passport
    {
        $email = trim($request->request->getString('_username'));
        $passwordPlain = trim($request->request->getString('_password'));

        // Very lame hashing applied here as required by BPN
        $password = md5($passwordPlain);

        try {
            $response = $this->apiClient->getPersonalData($email, $password);
        } catch (ApiClientException $e) {
            throw new CustomUserMessageAuthenticationException($e->getMessage());
        }

        if (false === $response instanceof PersonalData) {
            throw new CustomUserMessageAuthenticationException('Der Login ist fehlgeschlagen :(');
        }

        $csrfToken = $request->request->getString('_csrf_token');

        return new SelfValidatingPassport(
            new UserBadge($email, function () use ($email, $password, $response, $request) {
                $crmAttributes = $this->apiClient->getCrmAttributes($email, $password);
                $roles = $this->collectRoles($crmAttributes);
                $user = new User($email, $response->personId, $response->addressId, $password, $roles);

                $request->getSession()->set('bpn_user', $user);

                return $user;
            }),
            [
                new CsrfTokenBadge('authenticate', $csrfToken),
                new RememberMeBadge(),
            ]
        );
    }

    public function onAuthenticationSuccess(Request $request, TokenInterface $token, string $firewallName): ?Response
    {
        $this->logger->info('Login', [
            'email' => $token->getUserIdentifier(),
        ]);

        return new RedirectResponse($this->urlGenerator->generate('app_personal_data'));
    }

    private function collectRoles(CrmAttributes $crmAttributes): array
    {
        // Collect user's roles from CRM attributes
        $roles = [];

        if ($crmAttributes->admin) {
            $roles[] = 'ROLE_ADMIN';
        } elseif ($crmAttributes->manager) {
            $roles[] = 'ROLE_MANAGER';
        } elseif ($crmAttributes->houseManager) {
            $roles[] = 'ROLE_HOUSE_MANAGER';
        }

        if ($crmAttributes->teamer) {
            $roles[] = 'ROLE_TEAMER';
        }

        return $roles;
    }
}