<?php

namespace App\Support\Readiness;

use App\Mail\Transport\MailboxTransport;
use App\Models\Mailbox;
use App\Models\MailTemplate;
use App\Services\Secrets\SecretVault;

/**
 * What has to be in place for the customer to actually find out any of this
 * happened: a mail transport that leaves the server, an address to send
 * from, and — for support — a way to answer and to hear back.
 */
final class DeliveryChecks
{
    public const GROUP = 'delivery';

    /** @return array<int, Check> */
    public static function all(): array
    {
        return [
            new Check(
                key: 'delivery.mailer_not_log',
                group: self::GROUP,
                severity: Check::SEVERITY_BLOCKING,
                label: __('readiness.delivery.mailer_not_log'),
                breaks: __('readiness.delivery.mailer_not_log_breaks'),
                tab: 'mail',
                // Reads the transport's own definition of "does not really
                // send" rather than a second, narrower one. `!== 'log'` alone
                // called 'array' — the MAIL_MAILER this whole suite runs
                // under — delivered, which MailboxTransport::delegate() has
                // never agreed with.
                satisfied: ! in_array(config('mail.default'), MailboxTransport::NON_DELIVERING, true),
            ),
            new Check(
                key: 'delivery.mailbox',
                group: self::GROUP,
                severity: Check::SEVERITY_BLOCKING,
                label: __('readiness.delivery.mailbox'),
                breaks: __('readiness.delivery.mailbox_breaks'),
                tab: 'mail',
                satisfied: Mailbox::query()->exists(),
            ),
            new Check(
                key: 'delivery.mail_templates',
                group: self::GROUP,
                severity: Check::SEVERITY_WARNING,
                label: __('readiness.delivery.mail_templates'),
                breaks: __('readiness.delivery.mail_templates_breaks'),
                tab: 'templates',
                satisfied: MailTemplate::query()->exists(),
            ),
            new Check(
                // Named after the vault entry it checks (inbound_mail.password),
                // not a shorthand — see the identical reasoning on
                // onboarding.ssh_private_key in OnboardingChecks.php.
                key: 'delivery.inbound_mail_password',
                group: self::GROUP,
                severity: Check::SEVERITY_WARNING,
                label: __('readiness.delivery.inbound_password'),
                breaks: __('readiness.delivery.inbound_password_breaks'),
                // The inbound-mail card (host/port/user/folder + this
                // password) is on the 'services' tab — 'integrations' is not
                // a member of Integrations::TABS at all (Fix-Runde, Befund 1).
                tab: 'services',
                satisfied: filled(app(SecretVault::class)->get('inbound_mail.password')),
            ),
        ];
    }
}