<?php

namespace App\Console\Commands;

use App\Models\User;
use Illuminate\Console\Command;

/**
 * Idempotent first-run bootstrap (called by install.sh, phase 7).
 *
 * Creates the initial admin with the standard default password (operator decision: a
 * known, memorable default so login is never blocked by a missed one-time secret).
 * `must_change_password` is set, so the onboarding gate FORCES a new password on the
 * first login — the default is only valid until then. Re-running once an admin exists is
 * a hard no-op. NOTE: a known default credential is only acceptable because of the forced
 * rotation; the operator must change it immediately (banner / MOTD / README say so).
 */
class Install extends Command
{
    /** Standard default admin password — forced to change on first login (must_change_password). */
    private const DEFAULT_PASSWORD = 'clusev';

    /**
     * Standard default admin e-mail (login + Let's-Encrypt contact) when none is given. A fixed,
     * predictable value so a fresh, unattended install always logs in at admin@clusev.local —
     * not a host-derived address the operator would have to guess. Override with --email /
     * CLUSEV_ADMIN_EMAIL, or change it later under Settings → Profile.
     */
    private const DEFAULT_EMAIL = 'admin@clusev.local';

    protected $signature = "clusev:install
        {--email= : Admin-Login + Let's-Encrypt-E-Mail}
        {--name=Administrator : Anzeigename des Admins}";

    protected $description = 'Idempotenter Erstlauf: legt den ersten Admin mit Standard-Passwort an (Zwangswechsel beim ersten Login)';

    public function handle(): int
    {
        if (User::query()->exists()) {
            $this->info('Clusev ist bereits installiert — kein Admin angelegt.');

            return self::SUCCESS;
        }

        $email = (string) ($this->option('email') ?: self::DEFAULT_EMAIL);

        if (! filter_var($email, FILTER_VALIDATE_EMAIL)) {
            $this->error("Ungueltige Admin-E-Mail: {$email}");

            return self::FAILURE;
        }

        $password = self::DEFAULT_PASSWORD;

        $user = User::create([
            'name' => (string) ($this->option('name') ?: 'Administrator'),
            'email' => $email,
            'password' => $password,            // 'hashed' cast hashes on save
            'must_change_password' => true,     // forces a new password on first login
        ]);

        // install.sh greps these two lines for the closing banner. The password is the
        // standard default and must be changed on first login (must_change_password).
        $this->newLine();
        $this->line('CLUSEV_ADMIN_EMAIL='.$user->email);
        $this->line('CLUSEV_ADMIN_PASSWORD='.$password);
        $this->newLine();
        $this->info('Admin angelegt. Standard-Passwort — beim ersten Login sofort aendern.');

        return self::SUCCESS;
    }
}
