<?php

namespace App\Http\Controllers;

use App\Models\Server;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Cache;
use Illuminate\Support\Facades\Mail;
use Illuminate\Support\Facades\DB;

class ServerCredentialController extends Controller
{
    // Step 1: Generate and Email OTP
    public function requestOtp(Request $request, $serverId)
    {
        $server = Server::findOrFail($serverId);
        $user = auth()->user();
        
        // Generate a 6-digit OTP
        $otp = random_int(100000, 999999);
        
        // Store in cache for 5 minutes tied specifically to this user and server
        $cacheKey = "otp_{$user->id}_server_{$server->id}";
        Cache::put($cacheKey, $otp, now()->addMinutes(5));

        // Dispatch Email (You can replace this with a proper Mailable later)
        Mail::raw("Your OTP to view the credentials for {$server->name} ({$server->ip_address}) is: {$otp}. This code expires in 5 minutes.", function ($message) use ($user) {
            $message->to($user->email)
                    ->subject('Server Access Verification Code');
        });

        return response()->json([
            'success' => true,
            'message' => 'An OTP has been sent to your email.'
        ]);
    }

    // Step 2: Verify OTP and Release Password
    public function verifyOtp(Request $request, $serverId)
    {
        $request->validate(['otp' => 'required|numeric']);
        
        $user = auth()->user();
        $server = Server::findOrFail($serverId);
        $cacheKey = "otp_{$user->id}_server_{$server->id}";

        if (Cache::get($cacheKey) == $request->otp) {
            // Clear the OTP so it cannot be reused
            Cache::forget($cacheKey);

            // Log the access in the audit trail
            DB::table('password_access_audits')->insert([
                'user_id' => $user->id,
                'server_id' => $server->id,
                'ip_address' => $request->ip(),
                'user_agent' => $request->userAgent(),
                'accessed_at' => now(),
            ]);

            // Return the decrypted password (Laravel handles decryption automatically via the model cast)
            return response()->json([
                'success' => true,
                'username' => $server->username,
                'password' => $server->password 
            ]);
        }

        return response()->json(['success' => false, 'message' => 'Invalid or expired OTP.'], 422);
    }
}