<?php

declare(strict_types=1);

namespace KTXC\Console\Tenant;

use KTXC\Resource\ProviderManager;
use KTXC\Service\TenantService;
use Psr\Log\LoggerInterface;
use Symfony\Component\Console\Attribute\AsCommand;
use Symfony\Component\Console\Command\Command;
use Symfony\Component\Console\Input\InputArgument;
use Symfony\Component\Console\Input\InputInterface;
use Symfony\Component\Console\Input\InputOption;
use Symfony\Component\Console\Output\OutputInterface;
use Symfony\Component\Console\Style\SymfonyStyle;

/**
 * Tenant Auth Enable Command
 *
 * Enables an authentication provider for a tenant's login flow.
 */
#[AsCommand(
    name: 'tenant:auth:enable',
    description: 'Enable an authentication provider for a tenant',
)]
class TenantAuthEnableCommand extends Command
{
    public function __construct(
        private readonly TenantService $tenantService,
        private readonly ProviderManager $providerManager,
        private readonly LoggerInterface $logger
    ) {
        parent::__construct();
    }

    protected function configure(): void
    {
        $this
            ->addArgument('tenant', InputArgument::REQUIRED, 'Tenant identifier')
            ->addArgument('provider', InputArgument::REQUIRED, 'Authentication provider id (e.g. password, oidc, totp)')
            ->addOption('label', 'l', InputOption::VALUE_REQUIRED, 'Display label shown for this method during login')
            ->setHelp('This command enables an authentication provider for a tenant. The provider\'s module must already be installed and enabled.')
        ;
    }

    protected function execute(InputInterface $input, OutputInterface $output): int
    {
        $io = new SymfonyStyle($input, $output);
        $tenantIdentifier = $input->getArgument('tenant');
        $providerId = $input->getArgument('provider');

        $io->title('Enable Tenant Authentication Provider');

        try {
            $tenant = $this->tenantService->fetchById($tenantIdentifier);

            if (!$tenant) {
                $io->error("Tenant '{$tenantIdentifier}' not found.");
                return Command::FAILURE;
            }

            if (!$this->providerManager->resolve('authentication', $providerId)) {
                $io->error("Authentication provider '{$providerId}' is not registered. Is its module installed and enabled?");
                return Command::FAILURE;
            }

            $authentication = $tenant->getConfiguration()->authentication();
            $providers = $authentication->providers();
            $providers[$providerId] = array_filter([
                'enabled' => true,
                'label' => $input->getOption('label'),
            ], fn($value) => $value !== null);
            $authentication->jsonDeserialize(['providers' => $providers]);

            $this->tenantService->deposit($tenant);

            $this->logger->info('Tenant authentication provider enabled via console', [
                'tenant' => $tenantIdentifier,
                'provider' => $providerId,
                'command' => $this->getName(),
            ]);

            $io->success("Authentication provider '{$providerId}' enabled for tenant '{$tenantIdentifier}'.");

            return Command::SUCCESS;

        } catch (\Throwable $e) {
            $io->error('Failed to enable authentication provider: ' . $e->getMessage());
            $this->logger->error('Tenant auth provider enable failed', [
                'tenant' => $tenantIdentifier,
                'provider' => $providerId,
                'error' => $e->getMessage(),
            ]);
            return Command::FAILURE;
        }
    }
}