<?php

namespace App\Models;

use App\Enums\Users\RoleEnum;
use App\Traits\Models\ActivityLog;
use Illuminate\Auth\Access\AuthorizationException;
use Illuminate\Database\Eloquent\Factories\HasFactory;
use Illuminate\Foundation\Auth\User as Authenticatable;
use Illuminate\Notifications\Notifiable;
use Illuminate\Support\Facades\Hash;

/**
 * @property string                          $first_name   Prénom.
 * @property string                          $last_name    Nom.
 * @property string                          $email        Email.
 * @property string                          $password     Mot de passe.
 * @property \App\Enums\Users\RoleEnum       $role         Rôle.
 * @property \Illuminate\Support\Carbon      $published    État de publication.
 * @property \Illuminate\Support\Carbon      $published_at Date de mise à jour de l'état de publication.
 * @property-read \Illuminate\Support\Carbon $created_at   Created date.
 * @property-read \Illuminate\Support\Carbon $updated_at   Updated date.
 *
 * @property-read \App\Models\ActivityLog $activityLogs Activities logs One-to-many relationship.
 */
class User extends Authenticatable
{
    use ActivityLog;
    use HasFactory;
    use Notifiable;

    /**
     * The attributes that are mass assignable.
     *
     * @var array<int, string>
     */
    protected $fillable = [
        'first_name',
        'last_name',
        'email',
        'password',
        'role',
        'published',
        'published_at',
    ];

    /**
     * The attributes that should be hidden for serialization.
     *
     * @var array<int, string>
     */
    protected $hidden = [
        'password',
        'remember_token',
    ];

    /**
     * The attributes that should be cast.
     *
     * @var array<string, string>
     */
    protected $casts = [
        'role'              => RoleEnum::class,
        'email_verified_at' => 'datetime',
        'published'         => 'boolean',
    ];

    // * EVENTS

    /**
     * Perform any actions required after the model boots.
     *
     * @return void
     */
    protected static function booted(): void
    {
        static::creating(function (self $model) {
            self::updatePassword($model);
            // * Prevent user elevation privileges
            throw_if(
                auth('backend')->user() and auth('backend')->user()->role->value() > $model->role->value(),
                AuthorizationException::class
            );
        });
        static::updating(function (self $model) {
            self::updatePassword($model);
            if (optional(auth('backend')->user())->getKey() === $model->getKey()) {
                \validator(
                    ['published' => $model->published],
                    ['published' => 'required|boolean|accepted'],
                    ['published.accepted' => trans('Vous ne pouvez pas déactiver votre propre compte')],
                )->validate();
            }
            // * Prevent user elevation privileges
            throw_if(
                auth('backend')->user() and auth('backend')->user()->role->value() > $model->role->value(),
                AuthorizationException::class
            );
        });
    }

    // * METHODS

    /**
     * Update password.
     *
     * @param self $model
     * @return void
     */
    private static function updatePassword(self $model): void
    {
        if (Hash::needsRehash($model->password)) {
            $model->password = Hash::make($model->password);
        }
    }

    // * RELATIONS

    /**
     * Activities logs One-to-many relationship.
     *
     * @return \Illuminate\Database\Eloquent\Relations\HasMany
     */
    public function activityLogs(): \Illuminate\Database\Eloquent\Relations\HasMany
    {
        return $this->hasMany(ActivityLog::class);
    }
}