<?php

namespace App\Controllers;
use CodeIgniter\RESTful\ResourceController;
use App\Models\UserModel;
use App\Models\OrganizationModel;
use App\Models\GroupModel;
use App\Models\PolicyModel;
use App\Models\PolicyDetailsModel;
use App\Models\ServiceModel;

use League\OAuth2\Client\Provider\Exception\IdentityProviderException;
use TheNetworg\OAuth2\Client\Provider\Azure;
use Google\Client as GoogleClient;
use Google\Service\Oauth2;

class AuthController extends ResourceController
{
    protected $format = 'json';
    protected $userModel;
    protected $organizationModel;
    protected $groupModel;
    protected $policyModel;
    protected $policyDetailsModel;
    protected $serviceModel;
    protected $provider;
    protected $googleProvider;

    public function __construct()
    {
        helper('jwt_helper');
        helper('oauth_helper');
        $this->userModel = new UserModel();
        $this->organizationModel = new OrganizationModel();
        $this->groupModel = new GroupModel();
        $this->policyModel = new PolicyModel();
        $this->policyDetailsModel = new PolicyDetailsModel();
        $this->serviceModel = new ServiceModel();

        $this->provider = new Azure([
            'clientId'     => "9af66888-eb85-48ec-b3a0-ba857734f52b",
            'clientSecret' => "N2_8Q~FBEXtoZft2UgJ6FQZCh3ZIbJydYgxREbUb",
            // 'redirectUri'  => "https://apitest.tripapprovaltool.com/tstat/authredirection",
            // 'redirectUri'  => "https://apitest.tripapprovaltool.com/tstat_be/auth/msRedirectionHandler",
            'redirectUri'  => env('MS_REDIRECTION_URL'),
            'tenant'       => "284bf2b6-6dd8-4b46-881c-de45fde35736",
        ]);
        $this->provider->scope = [
            'openid',
            'profile',
            'email',
            'offline_access',
            'User.Read'
        ];
        
    }

    public function login()
    {
        
    
        $rules = [
            'email'    => 'required|valid_email',
            'password' => 'required'
        ];
    
        if (!$this->validate($rules)) {
            return $this->failValidationErrors($this->validator->getErrors());
        }
    
       
        $data = $this->request->getJSON();
        $user = $this->userModel->where('email', $data->email)->where('is_active',1)->first();
        // print_r($user);die;
        if (!$user) {
            return $this->failUnauthorized('Invalid email or password');
        }
    
        // Verify password (assuming it's hashed)
        if (!password_verify($data->password, $user['password'])) {
            return $this->failUnauthorized('Invalid email or password');
        }

        //update last login time in last_login_at column
        $this->userModel->update($user['user_id'], ['last_login_at' => date('Y-m-d H:i:s')]);


        $user = $this->userModel->where('email', $data->email)->first();
        if (!empty($user['last_login_at'])) {
            $user['last_login_at'] = date('d, M-Y h:iA', strtotime($user['last_login_at']));
        } else {
            $user['last_login_at'] = null; 
        }
        

        //get service for the organization
        $orgService = $this->organizationModel->find($user['org_id']);
        $user['service'] = json_decode($orgService['services_ids'],true);
        foreach ($user['service'] as $key => $value) 
        {
            $serviceData = $this->serviceModel->find($value['service_id']);
            $user['service'][$key]['name'] = $serviceData['name'];
            $user['service'][$key]['icon'] = $serviceData['icon'];
            $user['service'][$key]['order'] = $serviceData['order'];
        }

        //get role 
        $user['role'] = $this->userModel->getRole($user['role_id']);

        //find user has the all access 
        $user['plan_action'] = getUserPlanCreationRestrictionStatus($user);
    
        // Generate JWT Token
        $token = generateJWT($user);
        
    
        return $this->respond([
            'status' => 200,
            'message' => 'Login successful',
            'token' => $token
        ]);
    }

    public function oauthClient()
    {
        $orgData = $this->organizationModel->find(env('ORG_id'));

        if (!$orgData) {  return $this->failUnauthorized('Organization Id Not Set'); }

        return $this->respond([
            'status' => 200,
            'message' => 'success',
            'data' => ['oauth_client_id' => $orgData['oauth_client_id'] , 'oauth_client_secret' => $orgData['oauth_client_secret']]
        ]);
        
    }

    public function oauthlogin()
    {
        $rules = [
            'email'    => 'required|valid_email',
            'name'      => 'required',
        ];
    
        if (!$this->validate($rules)) {
            return $this->failValidationErrors($this->validator->getErrors());
        }
    
       
        $data = $this->request->getJSON();
        $user = $this->userModel->where('email', $data->email)->first();
        
        if (!$user) {
            $insert['email'] = $data->email;
            $insert['first_name'] = $data->name;
            $insert['org_id'] = env('ORG_id');
            $insert['role_id'] = 4;
            $userId = $this->userModel->insert($insert, true);
            $user = $this->userModel->where('user_id', $userId)->first();
        }
    
        //get service for the organization
        $orgService = $this->organizationModel->find($user['org_id']);
        $user['service'] = json_decode($orgService['services_ids'],true);
        foreach ($user['service'] as $key => $value) 
        {
            $serviceData = $this->serviceModel->find($value['service_id']);
            $user['service'][$key]['name'] = $serviceData['name'];
            $user['service'][$key]['icon'] = $serviceData['icon'];
        }

        //get role 
        $user['role'] = $this->userModel->getRole($user['role_id']);

        //find user has the all access 
        $user['plan_action'] = getUserPlanCreationRestrictionStatus($user);
    
        // Generate JWT Token
        $token = generateJWT($user);
        
    
        return $this->respond([
            'status' => 200,
            'message' => 'Login successful',
            'token' => $token
        ]);
    }

    //microsoft oAuth
    public function mslogin()
    {   
        $options = [
            'scope' => ['openid', 'email', 'profile', 'User.Read']
        ];

        $authUrl = $this->provider->getAuthorizationUrl($options);

        return $this->response->setJSON([
            'auth_url' => $authUrl
        ]);
    }

   
    public function verifyMSAuthUser()
    {
        
        $code    = $this->request->getVar('code');
        // echo $code; 
        try {
            $token = $this->provider->getAccessToken('authorization_code', [
                'code' => $code
            ]);
            
            $ownerDetails = $this->provider->getResourceOwner($token);
            $data = $ownerDetails->toArray();

            $name = $data['name'] ?? null;
            $email = $data['upn'] ?? $data['unique_name'] ?? null;
            
            $res = checkUserExist($name, $email);

            if($res['status'] == true)
            { 
                $user = $res['data'];
                //get service for the organization
                $orgService = $this->organizationModel->find($user['org_id']);
                $user['service'] = json_decode($orgService['services_ids'],true);
                foreach ($user['service'] as $key => $value) 
                {
                    $serviceData = $this->serviceModel->find($value['service_id']);
                    $user['service'][$key]['name'] = $serviceData['name'];
                    $user['service'][$key]['icon'] = $serviceData['icon'];
                }
        
                //get role 
                $user['role'] = $this->userModel->getRole($user['role_id']);
        
                //find user has the all access 
                $user['plan_action'] = getUserPlanCreationRestrictionStatus($user);

                $token = generateJWT($user);

                return $this->respond([ 'status' => 200,'message' => 'Login successful','token' => $token ]);

            }else{
                return $this->respond([ 'status' => 401,'message' => 'Login Failed','data' => [] ]);
            }


        } catch (IdentityProviderException $e) {
            exit($e->getMessage());
        }
        
    }
    //end of microsoft oAuth


    public function receiveGoogleOAuthResponse()
    {
        
        if ($this->request->getGet('code')) {

            $value = googleOAuthLogin($this->request->getGet('code'));
            if ($value) {

                $user = $this->userModel->where('email', $value->email)->first();
                // print_r($user);die;
                if (empty($user)) {
                    return $this->failUnauthorized('User Not Found');
                }

                if ($user['is_active'] == 0) {
                    return $this->failUnauthorized('User Not Active');
                }
                    
                //get service for the organization
                $orgService = $this->organizationModel->find($user['org_id']);
                $user['service'] = json_decode($orgService['services_ids'],true);
                foreach ($user['service'] as $key => $value) 
                {
                    $serviceData = $this->serviceModel->find($value['service_id']);
                    $user['service'][$key]['name'] = $serviceData['name'];
                    $user['service'][$key]['icon'] = $serviceData['icon'];
                    $user['service'][$key]['order'] = $serviceData['order'];
                }
        
                //get role 
                $user['role'] = $this->userModel->getRole($user['role_id']);
        
                //find user has the all access 
                $user['plan_action'] = getUserPlanCreationRestrictionStatus($user);
            
                // Generate JWT Token
                $token = generateJWT($user);
                
            
                return $this->respond([
                    'status' => 200,
                    'message' => 'Login successful',
                    'token' => $token
                ]);
            }
        } else {
            return $this->respond([
                'status' => 400,
                'message' => 'Login failed',
            ]);
        }
    }

    public function initiateGoogleOAuth()
    {   
        return googleOAuthLogin(false);
    }

    public function msRedirectionHandler()
    {
        $FeURL = env('FE_URL') . '#/authredirection?code=' . $this->request->getGet('code');

        return redirect()->to($FeURL);
    }


    //re-Fetch token

    public function refreshUserToken()
    {
        

        $user_id = $this->request->getGet();
        $user = $this->userModel->where('user_id', $user_id)->where('is_active',1)->first();
        // print_r($user);die;
        if (!$user) {
            return $this->failUnauthorized('Invalid User');
        }
    
      
        //get service for the organization
        $orgService = $this->organizationModel->find($user['org_id']);
        $user['service'] = json_decode($orgService['services_ids'],true);
        foreach ($user['service'] as $key => $value) 
        {
            $serviceData = $this->serviceModel->find($value['service_id']);
            $user['service'][$key]['name'] = $serviceData['name'];
            $user['service'][$key]['icon'] = $serviceData['icon'];
            $user['service'][$key]['order'] = $serviceData['order'];
        }

        //get role 
        $user['role'] = $this->userModel->getRole($user['role_id']);

        //find user has the all access 
        $user['plan_action'] = getUserPlanCreationRestrictionStatus($user);
    
        // Generate JWT Token
        $token = generateJWT($user);
        
    
        return $this->respond([
            'status' => 200,
            'message' => 'Login successful',
            'token' => $token
        ]);
    }


}