<?php

namespace App\Provisioning\Steps\Host;

use App\Models\ProvisioningRun;
use App\Provisioning\StepResult;
use App\Services\Proxmox\ProxmoxClient;

/**
 * Creates the automation role + user + API token on the host and stores the
 * (encrypted) token reference. The secret is shown only at creation, so the
 * token id is persisted before advancing.
 */
class CreateAutomationToken extends HostStep
{
    public function __construct(private ProxmoxClient $pve) {}

    public function key(): string
    {
        return 'create_automation_token';
    }

    public function execute(ProvisioningRun $run): StepResult
    {
        $host = $this->host($run);

        // Idempotent: token already minted and persisted.
        if ($this->hasResource($run, 'pve_token') && filled($host->api_token_ref)) {
            return StepResult::advance();
        }

        $client = $this->pve->forHost($host);
        $client->createRole(
            config('provisioning.proxmox.role_id'),
            config('provisioning.proxmox.role_privs'),
        );

        $token = $client->createUserAndToken(
            config('provisioning.proxmox.user'),
            config('provisioning.proxmox.role_id'),
        );

        if (blank($token['secret'] ?? null)) {
            return StepResult::retry(20, 'Proxmox token secret was empty');
        }

        $host->update(['api_token_ref' => $token['token_id'].'='.$token['secret']]);
        $this->recordResource($run, $host, 'pve_token', $token['token_id']);

        return StepResult::advance();
    }
}