<?php

namespace App\Http\Controllers\Admin;

use App\Http\Controllers\Controller;
use App\Http\Requests\Admin\UserRequest;
use App\Models\User;
use Illuminate\Http\RedirectResponse;
use Illuminate\Http\Request;
use Inertia\Inertia;
use Inertia\Response;

/**
 * Admin-only management of panel accounts (registration is disabled).
 */
class UserController extends Controller
{
    public function index(): Response
    {
        return Inertia::render('admin/users/index', [
            'users' => User::query()->orderBy('name')->get(['id', 'name', 'email', 'role', 'created_at']),
        ]);
    }

    public function store(UserRequest $request): RedirectResponse
    {
        $user = User::query()->create($request->safe()->only(['name', 'email', 'role', 'password']));
        // Accounts are created by an admin, so there is nothing left to verify.
        $user->forceFill(['email_verified_at' => now()])->save();

        Inertia::flash('toast', ['type' => 'success', 'message' => 'Pengguna ditambahkan.']);

        return back();
    }

    public function update(UserRequest $request, User $user): RedirectResponse
    {
        $data = $request->safe()->only(['name', 'email', 'role']);

        if ($request->filled('password')) {
            $data['password'] = $request->validated('password');
        }

        // Keep at least one admin: nobody may demote themselves.
        if ($user->is($request->user())) {
            unset($data['role']);
        }

        $user->update($data);

        Inertia::flash('toast', ['type' => 'success', 'message' => 'Pengguna diperbarui.']);

        return back();
    }

    public function destroy(Request $request, User $user): RedirectResponse
    {
        abort_if($user->is($request->user()), 403, 'Anda tidak dapat menghapus akun sendiri.');

        $user->delete();

        Inertia::flash('toast', ['type' => 'success', 'message' => 'Pengguna dihapus.']);

        return back();
    }
}