<?php

namespace App\Notifications;

use App\Models\Instance;
use Illuminate\Bus\Queueable;
use Illuminate\Notifications\Messages\MailMessage;
use Illuminate\Notifications\Notification;
use Illuminate\Support\Facades\Crypt;

/**
 * Delivers the initial admin credentials once provisioning completes.
 *
 * Sent SYNCHRONOUSLY from CompleteProvisioning (not queued): the step only
 * records the `credentials_sent` breadcrumb and scrubs the password AFTER the
 * send returns, so a mail failure re-runs the step (password preserved) instead
 * of losing the credential in a failed queue job. Delivery is at-least-once — a
 * crash in the tiny window after send but before the breadcrumb can re-send a
 * duplicate welcome email, which is preferable to a lost credential.
 */
class CloudReady extends Notification
{
    use Queueable;

    public function __construct(
        public Instance $instance,
        public string $adminUser,
        public string $adminPasswordEncrypted, // ciphertext — safe to serialize into the queue
    ) {}

    /** @return array<int, string> */
    public function via(object $notifiable): array
    {
        return ['mail'];
    }

    public function toMail(object $notifiable): MailMessage
    {
        $url = 'https://'.$this->instance->subdomain.'.'.config('provisioning.dns.zone');

        return (new MailMessage)
            ->subject(__('provisioning.mail.ready_subject'))
            ->greeting(__('provisioning.mail.ready_greeting'))
            ->line(__('provisioning.mail.ready_line'))
            ->line(__('provisioning.mail.ready_user', ['user' => $this->adminUser]))
            ->line(__('provisioning.mail.ready_password', ['password' => Crypt::decryptString($this->adminPasswordEncrypted)]))
            ->action(__('provisioning.mail.ready_action'), $url);
    }
}