<?php

namespace App\Http\Controllers\SystemSettings;

use App\Models\Auth\User;
use App\Models\Auth\UserAccessGroup;
use App\Utilities\SystemAccess;
use Illuminate\Http\Request;
use Illuminate\Routing\Controller;
use Illuminate\Support\Facades\DB;
use Illuminate\Validation\Rule;

class UserGroups extends Controller
{
    public function __construct()
    {
        $this->middleware(function ($request, $next) {
            abort_unless(SystemAccess::isSuperAdmin(), 403);
            return $next($request);
        });
    }

    public function index()
    {
        return view('system_settings.groups.index', ['groups' => UserAccessGroup::forCompany()->withCount('users')->orderBy('name')->get()]);
    }

    public function create()
    {
        return $this->form();
    }

    public function edit(int $group)
    {
        return $this->form(UserAccessGroup::forCompany()->findOrFail($group));
    }

    private function form(?UserAccessGroup $group = null)
    {
        return view('system_settings.groups.form', ['group' => $group, 'members' => $this->members(), 'selected' => $group?->users()->pluck('users.id')->all() ?? []]);
    }

    public function store(Request $request)
    {
        $group = new UserAccessGroup;
        $group->company_id = company_id();
        $group->page_permissions = [];
        return $this->save($request, $group);
    }

    public function update(Request $request, int $group)
    {
        return $this->save($request, UserAccessGroup::forCompany()->findOrFail($group));
    }

    private function save(Request $request, UserAccessGroup $group)
    {
        $data = $request->validate([
            'name' => ['required', 'string', 'max:80', Rule::unique('user_access_groups', 'name')->where('company_id', company_id())->ignore($group->id)],
            'members' => ['nullable', 'array'],
            'members.*' => ['integer', 'distinct', Rule::in($this->members()->pluck('id')->all())],
        ], [], ['name' => '分组名称', 'members' => '成员', 'members.*' => '成员']);
        DB::transaction(function () use ($group, $data) {
            $group->name = $data['name'];
            $group->save();
            $group->users()->sync($data['members'] ?? []);
        });
        flash('分组与成员已保存。页面权限在权限管理中设置。')->success();
        return redirect()->route('system-settings.groups.index');
    }

    public function destroy(int $group)
    {
        $group = UserAccessGroup::forCompany()->findOrFail($group);
        if ($group->users()->exists()) {
            return back()->withErrors(['group' => '请先移出分组成员，再删除空分组。移出最后一个分组的用户将恢复角色或系统默认权限。']);
        }
        $group->delete();
        flash('空分组已删除。')->success();
        return redirect()->route('system-settings.groups.index');
    }

    private function members()
    {
        return User::whereHas('companies', fn ($query) => $query->where('companies.id', company_id()))
            ->whereHas('roles', fn ($query) => $query->whereIn('name', ['admin', 'user']))
            ->whereDoesntHave('roles', fn ($query) => $query->where('name', 'super_admin'))->orderBy('name')->get();
    }
}