<?php

namespace App\Http\Controllers;

use App\Models\UserDosen;
use App\Models\UserStaff;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Auth;
use Illuminate\Support\Facades\Hash;
use Illuminate\Support\Facades\Log;

class AuthController extends Controller
{
    private function isBcryptHash(?string $value): bool
    {
        if (!$value) {
            return false;
        }

        return \is_string($value) && \preg_match('/^\\$2[aby]\\$/', $value) === 1;
    }

    /**
     * Show the login form
     */
    public function showLogin()
    {
        // Redirect jika sudah login
        if (Auth::check()) {
            return redirect()->route('welcome');
        }
        
        return view('auth.login');
    }

    /**
     * Handle login request
     */
    public function login(Request $request)
    {
        Log::info('Login attempt', ['nip' => $request->input('nip')]);

        // Validasi input
        $request->validate([
            'nip' => 'required|string',
            'password' => 'required|string',
        ], [
            'nip.required' => 'NIP harus diisi',
            'password.required' => 'Password harus diisi',
        ]);

        $nip = $request->input('nip');
        $password = $request->input('password');
        $remember = $request->boolean('remember');

        // Coba login sebagai Dosen
        $user = UserDosen::where('nip', $nip)->first();
        Log::info('Checking UserDosen', ['nip' => $nip, 'found' => $user ? 'yes' : 'no']);
        
        if (!$user) {
            // Coba login sebagai Staff
            $user = UserStaff::where('nip', $nip)->first();
            Log::info('Checking UserStaff', ['nip' => $nip, 'found' => $user ? 'yes' : 'no']);
        }

        $passwordMatch = false;
        $rehashPerformed = false;

        if ($user) {
            try {
                if ($this->isBcryptHash($user->password)) {
                    $passwordMatch = Hash::check($password, $user->password);
                } else {
                    // Jika password di DB masih plaintext / format lain, jangan sampai Hash::check melempar exception.
                    // Jika cocok, kita auto-hash untuk migrasi ke bcrypt.
                    $passwordMatch = \hash_equals((string) $user->password, (string) $password);

                    if ($passwordMatch) {
                        $user->password = Hash::make($password);
                        $user->save();
                        $rehashPerformed = true;
                    }
                }
            } catch (\Throwable $e) {
                Log::warning('Password check exception', [
                    'nip' => $nip,
                    'user_model' => get_class($user),
                    'message' => $e->getMessage(),
                ]);

                $passwordMatch = false;
            }
        }

        // Validasi user dan password
        if ($user && $passwordMatch) {
            Log::info('Password check passed', [
                'nip' => $nip,
                'user_model' => get_class($user),
                'rehash_performed' => $rehashPerformed ? 'yes' : 'no',
            ]);
            
            // Manually set authentication session
            // Ini memastikan baik UserDosen maupun UserStaff bisa login
            session()->regenerate();
            
            Auth::guard('web')->login($user, $remember);
            
            Log::info('Login successful', ['nip' => $nip, 'user_model' => get_class($user)]);
            
            return redirect()->route('welcome')->with('success', 'Login berhasil');
        }

        Log::warning('Login failed', [
            'nip' => $nip,
            'user_found' => $user ? 'yes' : 'no',
            'password_match' => $passwordMatch ? 'yes' : 'no',
        ]);

        // Login gagal
        return back()->withErrors([
            'nip' => 'NIP atau password tidak sesuai',
        ])->onlyInput('nip');
    }

    /**
     * Handle logout
     */
    public function logout(Request $request)
    {
        Auth::guard('web')->logout();
        $request->session()->invalidate();
        $request->session()->regenerateToken();

        return redirect()->route('login')->with('success', 'Logout berhasil');
    }
}