<?php

declare(strict_types=1);

namespace App\Controllers;

use App\Core\Access;
use App\Core\Controller;
use App\Core\Csrf;
use App\Models\AgentModel;
use App\Models\StructureModel;
use PDO;

final class RoleController extends Controller
{
    public function __construct(private PDO $pdo)
    {
    }

    public function index(): void
    {
        $access = new Access($this->pdo);

        if (($_GET['action'] ?? '') === 'reset') {
            $access->clear();
            header('Location: role.php', true, 302);
            exit;
        }

        $error = '';
        if (($_SERVER['REQUEST_METHOD'] ?? 'GET') === 'POST') {
            $expected = Csrf::ensureToken();
            $provided = (string) ($_POST['csrf_token'] ?? '');
            if ($provided === '' || !hash_equals($expected, $provided)) {
                $error = 'La session a expiré. Rechargez la page et recommencez.';
            } else {
                try {
                    $role = strtoupper(trim((string) ($_POST['role'] ?? '')));
                    $agentId = filter_var($_POST['agent_id'] ?? null, FILTER_VALIDATE_INT) ?: null;
                    $structureId = filter_var($_POST['structure_id'] ?? null, FILTER_VALIDATE_INT) ?: null;
                    $access->select($role, $agentId ? (int) $agentId : null, $structureId ? (int) $structureId : null);
                    header('Location: ' . $access->homeUrl(), true, 302);
                    exit;
                } catch (\DomainException $e) {
                    $error = $e->getMessage();
                }
            }
        }

        $this->render('pages/role', [
            'pageTitle' => 'Choisir votre accès',
            'csrfToken' => Csrf::ensureToken(),
            'agents' => (new AgentModel($this->pdo))->allActive(),
            'structures' => (new StructureModel($this->pdo))->allActive(),
            'error' => $error,
            'currentProfile' => $access->isConfigured() ? $access->profile() : null,
        ]);
    }
}