<?php

namespace App\Http\Controllers\Admin;

use App\Http\Controllers\Controller;
use App\Models\Application;
use App\Models\Applicant;
use App\Models\JobListing;
use App\Models\NotificationLog;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Auth;
use Illuminate\Support\Facades\Hash;
use App\Models\User;

class AuthController extends Controller
{
    public function showLogin()
    {
        if (Auth::check() && Auth::user()->is_admin) {
            return redirect()->route('admin.dashboard');
        }
        return view('admin.login');
    }

    public function login(Request $request)
    {
        $request->validate([
            'username' => 'required',
            'password' => 'required',
        ]);

        // Rate limiting: max 5 login attempts per IP per 5 minutes
        $rateLimitKey = 'admin_login_' . md5($request->ip());
        $attempts = (int) cache($rateLimitKey, 0);
        if ($attempts >= 5) {
            return back()->withErrors(['username' => 'Terlalu banyak percobaan login. Silakan coba lagi dalam 5 menit.'])->withInput();
        }

        $user = User::where('name', $request->username)->first();

        if ($user && Hash::check($request->password, $user->password) && $user->is_admin) {
            // Reset rate limit on successful login
            cache()->forget($rateLimitKey);

            // Preserve applicant session if any
            $applicantId = session('applicant_id');

            Auth::login($user);
            $request->session()->regenerate(); // Session fixation protection

            // Restore applicant session
            if ($applicantId) {
                session(['applicant_id' => $applicantId]);
            }

            return redirect()->route('admin.dashboard');
        }

        // Increment rate limit on failed login
        cache([$rateLimitKey => $attempts + 1], now()->addMinutes(5));

        return back()->withErrors(['username' => 'Username atau password salah.'])->withInput();
    }
    public function logout(Request $request)
    {
        // Preserve applicant session
        $applicantId = session('applicant_id');

        Auth::logout();
        $request->session()->invalidate();
        $request->session()->regenerateToken();

        // Restore applicant session if existed
        if ($applicantId) {
            session(['applicant_id' => $applicantId]);
        }

        return redirect()->route('admin.login');
    }

    public function dashboard()
    {
        $totalJobs = JobListing::count();
        $activeJobs = JobListing::where('is_active', true)->count();
        $recentJobs = JobListing::latest()
            ->take(8)
            ->get(['id', 'title', 'company', 'location', 'is_active']);
        $totalApplicants = Applicant::count();
        $totalApplications = Application::count();
        $recentApplications = Application::with(['applicant', 'jobListing.stages'])
            ->latest()
            ->take(10)
            ->get();

        // Dynamic status counts
        $statusCounts = Application::selectRaw('status, count(*) as total')
            ->groupBy('status')
            ->pluck('total', 'status')
            ->toArray();

        $notificationStats = [
            'sent' => NotificationLog::where('status', 'sent')->count(),
            'failed' => NotificationLog::where('status', 'failed')->count(),
            'pending' => NotificationLog::where('status', 'pending')->count(),
        ];

        return view('admin.dashboard', compact(
            'totalJobs', 'activeJobs', 'recentJobs', 'totalApplicants',
            'totalApplications', 'recentApplications', 'statusCounts', 'notificationStats'
        ));
    }
}