<?php

namespace App\Models\Central;

use Filament\Auth\MultiFactor\App\Contracts\HasAppAuthentication;
use Filament\Auth\MultiFactor\App\Contracts\HasAppAuthenticationRecovery;
use Filament\Auth\MultiFactor\Email\Contracts\HasEmailAuthentication;
use Filament\Models\Contracts\FilamentUser;
use Filament\Panel;
use Illuminate\Contracts\Auth\MustVerifyEmail;
use Illuminate\Database\Eloquent\Factories\HasFactory;
use Illuminate\Foundation\Auth\User as Authenticatable;
use Illuminate\Notifications\Notifiable;
use Laravel\Sanctum\HasApiTokens;

class SuperAdmin extends Authenticatable implements FilamentUser, HasAppAuthentication, HasAppAuthenticationRecovery, HasEmailAuthentication
{
    use HasApiTokens, HasFactory, Notifiable;

    protected $table = 'super_admins';

    public const ROLES = [
        'owner' => 'Proprietar (toate drepturile)',
        'admin' => 'Administrator',
        'support' => 'Suport (read-only + acces tenanți)',
        'sales' => 'Vânzări (gestiune Companii + Plans)',
        'finance' => 'Financiar (Subscriptions + facturi)',
    ];

    protected $fillable = [
        'name', 'email', 'phone', 'password', 'is_active', 'role', 'notes', 'last_login_at',
        'email_authentication_at',
        'app_authentication_secret', 'app_authentication_recovery_codes',
    ];

    protected $hidden = [
        'password', 'remember_token',
    ];

    protected function casts(): array
    {
        return [
            'email_verified_at' => 'datetime',
            'last_login_at' => 'datetime',
            'email_authentication_at' => 'datetime',
            'password' => 'hashed',
            'is_active' => 'boolean',
            'app_authentication_secret' => 'encrypted',
            'app_authentication_recovery_codes' => 'encrypted:array',
        ];
    }

    public function canAccessPanel(Panel $panel): bool
    {
        return $panel->getId() === 'central' && $this->is_active;
    }

    public function isOwner(): bool { return $this->role === 'owner'; }
    public function isAdmin(): bool { return in_array($this->role, ['owner', 'admin'], true); }
    public function canManageBilling(): bool { return in_array($this->role, ['owner', 'admin', 'finance'], true); }
    public function canManageTenants(): bool { return in_array($this->role, ['owner', 'admin', 'sales'], true); }

    public function hasEmailAuthentication(): bool
    {
        return $this->email_authentication_at !== null;
    }

    public function toggleEmailAuthentication(bool $condition): void
    {
        $this->forceFill([
            'email_authentication_at' => $condition ? now() : null,
        ])->saveQuietly();
    }

    public function getAppAuthenticationSecret(): ?string
    {
        return $this->app_authentication_secret;
    }

    public function saveAppAuthenticationSecret(?string $secret): void
    {
        $this->forceFill(['app_authentication_secret' => $secret])->saveQuietly();
    }

    public function getAppAuthenticationHolderName(): string
    {
        return $this->email;
    }

    public function getAppAuthenticationRecoveryCodes(): ?array
    {
        return $this->app_authentication_recovery_codes;
    }

    public function saveAppAuthenticationRecoveryCodes(?array $codes): void
    {
        $this->forceFill(['app_authentication_recovery_codes' => $codes])->saveQuietly();
    }
}