<?php

namespace App\Http\Controllers;

use App\Models\User;
use Illuminate\Http\RedirectResponse;
use Illuminate\Support\Facades\Auth;
use Illuminate\Support\Str;
use Laravel\Socialite\Facades\Socialite;

class OAuthController extends Controller
{
    public function redirect(): RedirectResponse
    {
        return Socialite::driver('nextcloud')->redirect();
    }

    public function callback(): RedirectResponse
    {
        $socialUser = Socialite::driver('nextcloud')->user();

        $ncGroups = $socialUser->getRaw()['ocs']['data']['groups'] ?? [];
        $smsRoles = array_intersect($ncGroups, ['sms-admin', 'sms-manager', 'sms-viewer']);

        if (empty($smsRoles)) {
            abort(403, 'Kein Zugriff — bitte einer SMS-Gruppe in Nextcloud beitreten.');
        }

        $nextcloudId = (string) $socialUser->getId();

        $user = User::where('nextcloud_id', $nextcloudId)->first();

        if (! $user) {
            $user = User::where('email', $socialUser->getEmail())->first();

            if (! $user) {
                $user = new User([
                    'name'     => $socialUser->getName() ?? $socialUser->getNickname() ?? $socialUser->getEmail(),
                    'email'    => $socialUser->getEmail(),
                    'password' => Str::random(40),
                ]);
            }

            $user->nextcloud_id = $nextcloudId;
            $user->save();
        }

        $user->syncRoles(array_values($smsRoles));

        Auth::login($user, remember: true);

        return redirect('/dashboard');
    }
}