<?php

namespace App\Http\Controllers;

use App\Models\User;
use Illuminate\Http\RedirectResponse;
use Illuminate\Support\Facades\Auth;
use Illuminate\Support\Str;
use Laravel\Socialite\Facades\Socialite;

class OAuthController extends Controller
{
    public function redirect(): RedirectResponse
    {
        return Socialite::driver('nextcloud')->redirect();
    }

    public function callback(): RedirectResponse
    {
        $socialUser = Socialite::driver('nextcloud')->user();

        $ncGroups = $socialUser->getRaw()['ocs']['data']['groups'] ?? [];
        $smsRoles = array_intersect($ncGroups, ['sms-admin', 'sms-manager', 'sms-viewer']);

        if (empty($smsRoles)) {
            abort(403, 'Kein Zugriff — bitte einer SMS-Gruppe in Nextcloud beitreten.');
        }

        $user = User::firstOrCreate(
            ['email' => $socialUser->getEmail()],
            [
                'name'     => $socialUser->getName() ?? $socialUser->getNickname() ?? $socialUser->getEmail(),
                'password' => Str::random(40),
            ]
        );

        $user->syncRoles(array_values($smsRoles));

        Auth::login($user, remember: true);

        return redirect('/dashboard');
    }
}