<?php

namespace App\Providers;

use App\Actions\Fortify\CreateNewUser;
use App\Actions\Fortify\RedirectIfTwoFactorAuthenticatable;
use App\Actions\Fortify\ResetUserPassword;
use App\Actions\Fortify\UpdateUserPassword;
use App\Actions\Fortify\UpdateUserProfileInformation;
use App\Http\Responses\TwoFactorLoginResponse;
use App\Master\LoginService;
use Illuminate\Cache\RateLimiting\Limit;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\App;
use Illuminate\Support\Facades\Hash;
use Illuminate\Support\Facades\RateLimiter;
use Illuminate\Support\ServiceProvider;
use Laravel\Fortify\Contracts\RedirectsIfTwoFactorAuthenticatable;
use Laravel\Fortify\Contracts\TwoFactorLoginResponse as TwoFactorLoginResponseContract;
use Laravel\Fortify\Fortify;
use Mtc\MercuryDataModels\User;
use Illuminate\Validation\ValidationException;

class FortifyServiceProvider extends ServiceProvider
{
    /**
     * Register any application services.
     *
     * @return void
     */
    #[\Override]
    public function register()
    {
        // Bind our custom RedirectIfTwoFactorAuthenticatable action
        // This checks for remembered devices before triggering 2FA challenge
        $this->app->singleton(
            RedirectsIfTwoFactorAuthenticatable::class,
            RedirectIfTwoFactorAuthenticatable::class
        );

        // Bind our custom TwoFactorLoginResponse
        // This sets the remember device cookie after successful 2FA
        $this->app->singleton(
            TwoFactorLoginResponseContract::class,
            TwoFactorLoginResponse::class
        );
    }

    /**
     * Bootstrap any application services.
     *
     * @return void
     */
    public function boot()
    {
        Fortify::createUsersUsing(CreateNewUser::class);
        Fortify::updateUserProfileInformationUsing(UpdateUserProfileInformation::class);
        Fortify::updateUserPasswordsUsing(UpdateUserPassword::class);
        Fortify::resetUserPasswordsUsing(ResetUserPassword::class);

        RateLimiter::for('login', fn (Request $request) => Limit::perMinute(5)->by($request->email . $request->ip()));

        RateLimiter::for(
            'two-factor',
            fn (Request $request) => Limit::perMinute(5)->by($request->session()->get('login.id'))
        );

        Fortify::authenticateUsing(function (Request $request) {
            $loginService = App::make(LoginService::class);

            $loginService->check($request->input());

            $user = User::where('email', $request->email)->first();

            if (
                $user &&
                Hash::check($request->password, $user->password)
            ) {
                return $user;
            } elseif ($loginService->isMtc()) {
                throw ValidationException::withMessages([
                    Fortify::username() => trans('auth.failed_mtc'),
                ]);
            }
        });
    }
}
