<?php

namespace App\Models;

use App\Mail\VerifyEmailMail;
use Database\Factories\UserFactory;
use Illuminate\Contracts\Auth\MustVerifyEmail;
use Illuminate\Database\Eloquent\Attributes\Fillable;
use Illuminate\Database\Eloquent\Attributes\Hidden;
use Illuminate\Database\Eloquent\Factories\HasFactory;
use Illuminate\Foundation\Auth\User as Authenticatable;
use Illuminate\Notifications\Notifiable;
use Illuminate\Support\Facades\Mail;
use Laravel\Fortify\TwoFactorAuthenticatable;

#[Fillable(['name', 'email', 'password'])]
#[Hidden(['password', 'remember_token', 'two_factor_secret', 'two_factor_recovery_codes'])]
class User extends Authenticatable implements MustVerifyEmail
{
    /** @use HasFactory<UserFactory> */
    use HasFactory, Notifiable, TwoFactorAuthenticatable;

    /**
     * The reset mail in this product's design, not the framework's.
     *
     * Somebody who has just been locked out is exactly the person a phishing
     * mail is aimed at. A message that looks nothing like the rest of our post
     * is one they cannot check — and ours carries the footer naming our
     * domains, which is the whole point.
     */
    public function sendPasswordResetNotification(#[\SensitiveParameter] $token): void
    {
        $mail = new \App\Mail\ResetPasswordMail(
            $this,
            route('password.reset', ['token' => $token, 'email' => $this->email]),
            (int) config('auth.passwords.users.expire', 60),
        );
        \Illuminate\Support\Facades\Mail::mailer($mail->mailer)->to($this->email)->send($mail);
    }

    /**
     * The confirmation mail, in this product's design rather than Laravel's.
     *
     * Overridden instead of going through VerifyEmail::toMailUsing(), which
     * hands back a MailMessage — the framework's markdown layout, with its
     * own logo, its own button and its own footer. This is the first thing
     * anybody ever receives from CluPilot; it should not arrive looking like a
     * framework's default.
     *
     * It also has to go out through the SYSTEM mailbox like every other
     * account mail (App\Services\Mail\MailPurpose), which the notification
     * path does not do on its own.
     */
    public function sendEmailVerificationNotification(): void
    {
        $mail = new VerifyEmailMail($this);
        Mail::mailer($mail->mailer)->to($this->getEmailForVerification())->queue($mail);
    }

    /**
     * Get the attributes that should be cast.
     *
     * @return array<string, string>
     */
    protected function casts(): array
    {
        return [
            'email_verified_at' => 'datetime',
            // When we told this account it would be removed for having no
            // package — see App\Console\Commands\PruneDormantAccounts.
            'dormant_warned_at' => 'datetime',
            'password' => 'hashed',
            // is_admin itself is dead: nothing reads it any more (see
            // Operator/the operator guard). The column stays because dropping
            // it is a schema change this task does not need to make.
        ];
    }
}
