<?php

namespace App\Services;

use Illuminate\Support\Facades\Log;

class UserService extends ApiService
{
    /**
     * Autenticar usuario con credenciales
     * El backend determina si es admin o asesor
     */
    public function authenticate(string $username, string $password): ?array
    {
        try {
            // Usar un solo endpoint que maneje tanto admin como asesor
            $response = $this->makeApiRequest('POST', api_url('auth.login'), [
                'username' => $username,
                'password' => $password
            ], [], 'user_authenticate');

            if (!$response['success']) {
                Log::info('UserService authentication failed', [
                    'username' => $username,
                    'error' => $response['message'] ?? 'Error desconocido'
                ]);
                return null;
            }

            $data = $response['data'] ?? [];
            // Extraer token - la API devuelve access_token directamente en el nivel principal
            $token = $data['access_token'] ?? $data['token'] ?? null;
            $userData = $data['user'] ?? $data['advisor'] ?? null;
            
            // Extraer tipo de usuario correctamente
            $userType = null;
            if ($userData && isset($userData['type'])) {
                $userType = $userData['type'];
            } else {
                $userType = 'regular'; // valor por defecto
            }
            

            // Solo permitir admin y commercial_advisor, rechazar regular
            if (!in_array($userType, ['admin', 'commercial_advisor', 'advisor'])) {
                Log::info('UserService authentication rejected - unauthorized user type', [
                    'username' => $username,
                    'user_type' => $userType,
                    'allowed_types' => ['admin', 'commercial_advisor', 'advisor'],
                    'message' => 'Solo administradores y asesores comerciales pueden acceder'
                ]);
                return null;
            }

            if ($token && $userData) {
                return [
                    'token' => $token,
                    'user' => $userData,
                    'user_type' => $userType,
                    'permissions' => $this->getPermissionsByUserType($userType),
                    'success' => true
                ];
            }

            return null;
        } catch (\Exception $e) {
            Log::error('UserService authentication error', [
                'username' => $username,
                'error' => $e->getMessage()
            ]);
            return null;
        }
    }

    /**
     * Obtener permisos según el tipo de usuario
     */
    private function getPermissionsByUserType(string $userType): array
    {
        switch ($userType) {
            case 'admin':
                return $this->getAdminPermissions();
            case 'commercial_advisor':
            case 'advisor':
                return $this->getAdvisorPermissions();
            default:
                return []; // Sin permisos para tipos no reconocidos
        }
    }

    /**
     * Obtener permisos para administradores
     */
    private function getAdminPermissions(): array
    {
        return [
            // Permisos completos para admin
            'view_dashboard' => true,
            'view_companies' => true,
            'view_own_clients' => true,
            'view_reports' => true,
            'view_commissions' => true,
            'edit_profile' => true,
            'manage_advisors' => true,
            'manage_users' => true,
            'manage_system' => true,
            'view_all_companies' => true,
            'manage_access_requests' => true,
            'manage_plans' => true,
            'view_system_reports' => true,
            'export_data' => true,
        ];
    }

    /**
     * Obtener permisos para asesores comerciales
     */
    private function getAdvisorPermissions(): array
    {
        return [
            'view_dashboard' => true,
            'view_companies' => true,
            'view_payments' => true,
            'view_own_clients' => true,
            'view_reports' => true,
            'view_commissions' => true,
            'edit_profile' => true,
            // Permisos restringidos (solo admin)
            'manage_advisors' => false,
            'manage_users' => false,
            'manage_system' => false,
            'manage_access_requests' => false,
            'manage_plans' => false,
            'view_all_companies' => false,
        ];
    }

    /**
     * Obtener lista de usuarios
     */
    public function getUsers(array $filters = []): array
    {
        $response = $this->makeApiRequest('GET', 'users', [], $filters, 'get_users');

        if (!$response['success']) {
            throw new \Exception($response['message'] ?? 'Error al obtener usuarios');
        }

        return $response;
    }

    /**
     * Obtener un usuario por ID
     */
    public function getUser(int $id): array
    {
        $response = $this->makeApiRequest('GET', "users/{$id}", [], [], 'get_user');

        if (!$response['success']) {
            throw new \Exception($response['message'] ?? 'Error al obtener usuario');
        }

        return $response['data'] ?? [];
    }

    /**
     * Crear un nuevo usuario
     */
    public function createUser(array $data): array
    {
        $response = $this->makeApiRequest('POST', 'users', $data, [], 'create_user');

        if (!$response['success']) {
            throw new \Exception($response['message'] ?? 'Error al crear usuario');
        }

        return $response['data'] ?? [];
    }

    /**
     * Actualizar un usuario
     */
    public function updateUser(int $id, array $data): array
    {
        $response = $this->makeApiRequest('PUT', "users/{$id}", $data, [], 'update_user');

        if (!$response['success']) {
            throw new \Exception($response['message'] ?? 'Error al actualizar usuario');
        }

        return $response['data'] ?? [];
    }

    /**
     * Eliminar un usuario
     */
    public function deleteUser(int $id): bool
    {
        $response = $this->makeApiRequest('DELETE', "users/{$id}", [], [], 'delete_user');

        if (!$response['success']) {
            throw new \Exception($response['message'] ?? 'Error al eliminar usuario');
        }

        return true;
    }

    /**
     * Obtener roles disponibles
     */
    public function getRoles(): array
    {
        $response = $this->makeApiRequest('GET', 'roles', [], [], 'get_roles');

        if (!$response['success']) {
            throw new \Exception($response['message'] ?? 'Error al obtener roles');
        }

        return $response['data'] ?? [];
    }

    /**
     * Asignar rol a usuario
     */
    public function assignRole(int $userId, int $roleId): bool
    {
        $response = $this->makeApiRequest('POST', "users/{$userId}/roles", ['role_id' => $roleId], [], 'assign_role');

        if (!$response['success']) {
            throw new \Exception($response['message'] ?? 'Error al asignar rol al usuario');
        }

        return true;
    }

    /**
     * Quitar rol de usuario
     */
    public function removeRole(int $userId, int $roleId): bool
    {
        $response = $this->makeApiRequest('DELETE', "users/{$userId}/roles/{$roleId}", [], [], 'remove_role');

        if (!$response['success']) {
            throw new \Exception($response['message'] ?? 'Error al remover rol del usuario');
        }

        return true;
    }

}