<?php

namespace App\Console\Commands;

use App\Models\User;
use Illuminate\Console\Command;
use Illuminate\Support\Str;

/**
 * Idempotent first-run bootstrap (called by install.sh, phase 7).
 *
 * Creates the initial admin with a one-time random password that is printed
 * exactly once on stdout — never written to .env, a file, or the database in
 * plaintext. Re-running once an admin exists is a hard no-op (INSTALL_LOCK
 * idiom): no default credential, no "first-visitor-wins" claim window.
 */
class Install extends Command
{
    protected $signature = "clusev:install
        {--email= : Admin-Login + Let's-Encrypt-E-Mail}
        {--name=Administrator : Anzeigename des Admins}";

    protected $description = 'Idempotenter Erstlauf: legt den ersten Admin mit Einmal-Zufallspasswort an';

    public function handle(): int
    {
        if (User::query()->exists()) {
            $this->info('Clusev ist bereits installiert — kein Admin angelegt.');

            return self::SUCCESS;
        }

        $host = parse_url((string) config('app.url'), PHP_URL_HOST) ?: 'localhost';
        $email = (string) ($this->option('email') ?: "admin@{$host}");

        if (! filter_var($email, FILTER_VALIDATE_EMAIL)) {
            $this->error("Ungueltige Admin-E-Mail: {$email}");

            return self::FAILURE;
        }

        $password = Str::password(20);

        $user = User::create([
            'name' => (string) ($this->option('name') ?: 'Administrator'),
            'email' => $email,
            'password' => $password,            // 'hashed' cast hashes on save
            'must_change_password' => true,     // forces rotate + 2FA on first login
        ]);

        // One-time password marker — the ONLY place the plaintext appears.
        // install.sh greps these two lines for the closing banner; never stored.
        $this->newLine();
        $this->line('CLUSEV_ADMIN_EMAIL='.$user->email);
        $this->line('CLUSEV_ADMIN_PASSWORD='.$password);
        $this->newLine();
        $this->info('Admin angelegt. Passwort erscheint nur jetzt und wird nicht gespeichert.');

        return self::SUCCESS;
    }
}