<?php

namespace App\Http\Controllers;

use App\Models\Certificate;
use App\Models\Share;
use App\Services\CertificateZipper;
use Illuminate\Contracts\View\View;
use Illuminate\Http\RedirectResponse;
use Illuminate\Http\Request;
use Illuminate\Http\Response;
use Illuminate\Support\Facades\Storage;
use Symfony\Component\HttpFoundation\BinaryFileResponse;
use Symfony\Component\HttpFoundation\StreamedResponse;

/**
 * Public page where external recipients view a share and download its
 * certificates. Authorization is the unguessable token in the URL (plus the
 * optional share password); this runs unauthenticated, so the owner scope
 * on Share/Certificate no-ops.
 */
class SharePageController extends Controller
{
    public function show(Share $share): View|Response
    {
        if (! $share->isActive()) {
            return response()->view('shared.expired', status: 410);
        }

        if (! $this->isUnlocked($share)) {
            return view('shared.unlock', ['share' => $share]);
        }

        $share->recordAccess();

        return view('shared.show', [
            'share' => $share,
            'certificates' => $share->certificates()->whereNotNull('file_path')->orderBy('title')->get(),
        ]);
    }

    public function unlock(Request $request, Share $share): RedirectResponse
    {
        abort_unless($share->isActive(), 410);

        $validated = $request->validate(['password' => ['required', 'string']]);

        if ($share->password === null || ! hash_equals($share->password, $validated['password'])) {
            return back()->withErrors(['password' => __('The password is incorrect.')]);
        }

        $request->session()->put($this->sessionKey($share), true);

        return redirect()->route('shared.show', $share->token);
    }

    public function download(Share $share, Certificate $certificate): StreamedResponse
    {
        $this->authorizeDownload($share);

        abort_unless(filled($certificate->file_path) && Storage::disk('local')->exists($certificate->file_path), 404);

        return Storage::disk('local')->download(
            $certificate->file_path,
            $certificate->title.'.'.pathinfo($certificate->file_path, PATHINFO_EXTENSION),
        );
    }

    public function zip(Share $share): BinaryFileResponse
    {
        $this->authorizeDownload($share);

        $certificates = $share->certificates()->whereNotNull('file_path')->get();

        abort_if($certificates->isEmpty(), 404);

        $zipPath = app(CertificateZipper::class)->create($certificates, $share->password);

        return response()->download($zipPath, 'certificates.zip')->deleteFileAfterSend();
    }

    private function authorizeDownload(Share $share): void
    {
        abort_unless($share->isActive(), 410);
        abort_unless($this->isUnlocked($share), 403);
    }

    private function isUnlocked(Share $share): bool
    {
        return $share->password === null || session()->get($this->sessionKey($share)) === true;
    }

    private function sessionKey(Share $share): string
    {
        return 'share-unlocked:'.$share->id;
    }
}