<?php

namespace App\Models;

// use Illuminate\Contracts\Auth\MustVerifyEmail;
use App\Notifications\ResetPasswordNotification;
use Illuminate\Database\Eloquent\Factories\HasFactory;
use Illuminate\Foundation\Auth\User as Authenticatable;
use Illuminate\Notifications\Notifiable;
use Laravel\Sanctum\HasApiTokens;
use Spatie\Permission\Traits\HasRoles;

class User extends Authenticatable
{
    /** @use HasFactory<\Database\Factories\UserFactory> */
    use HasFactory, Notifiable, HasApiTokens, HasRoles;

    /**
     * The attributes that are mass assignable.
     *
     * @var list<string>
     */
    protected $fillable = [
        'name',
        'email',
        'password',
        'two_factor_enabled',
        'two_factor_setup_at',
    ];

    /**
     * The attributes that should be hidden for serialization.
     *
     * @var list<string>
     */
    protected $hidden = [
        'password',
        'remember_token',
    ];

    /**
     * Get the attributes that should be cast.
     *
     * @return array<string, string>
     */
    protected function casts(): array
    {
        return [
            'email_verified_at' => 'datetime',
            'password' => 'hashed',
            'two_factor_enabled' => 'boolean',
            'two_factor_setup_at' => 'datetime',
        ];
    }

    /**
     * Send the password reset notification.
     *
     * @param  string  $token
     */
    public function sendPasswordResetNotification($token): void
    {
        $this->notify(new ResetPasswordNotification($token));
    }

    /**
     * Get the two-factor codes for this user.
     */
    public function twoFactorCodes()
    {
        return $this->morphMany(TwoFactorCode::class, 'authenticatable');
    }

    /**
     * Get the two-factor sessions for this user.
     */
    public function twoFactorSessions()
    {
        return $this->morphMany(TwoFactorSession::class, 'authenticatable');
    }

    /**
     * Check if two-factor authentication is enabled.
     */
    public function hasTwoFactorEnabled(): bool
    {
        return $this->two_factor_enabled;
    }

    /**
     * Check if user has completed two-factor setup.
     */
    public function hasCompletedTwoFactorSetup(): bool
    {
        return ! is_null($this->two_factor_setup_at);
    }

    /**
     * Check if user needs to set up two-factor authentication.
     */
    public function needsTwoFactorSetup(): bool
    {
        // Admins always need 2FA, and if they haven't set it up yet, they need to
        return ! $this->hasCompletedTwoFactorSetup();
    }

    /**
     * Check if user can disable two-factor authentication.
     */
    public function canDisableTwoFactor(): bool
    {
        // Admin users can NEVER disable 2FA
        return false;
    }

    /**
     * Enable two-factor authentication for this user.
     */
    public function enableTwoFactor(): void
    {
        $this->two_factor_enabled = true;
        if (! $this->two_factor_setup_at) {
            $this->two_factor_setup_at = now();
        }
        $this->save();
    }

    /**
     * Disable two-factor authentication for this user.
     * Admin users cannot disable 2FA.
     */
    public function disableTwoFactor(): void
    {
        throw new \RuntimeException('Admin users cannot disable two-factor authentication.');
    }
}
