<?php

declare(strict_types=1);

namespace App\Http\Requests\Uploads;

use App\Models\Artwork;
use App\Repositories\Uploads\UploadSessionRepository;
use App\Services\Uploads\UploadTokenService;
use Illuminate\Foundation\Http\FormRequest;
use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;

final class UploadFinishRequest extends FormRequest
{
    private ?Artwork $artwork = null;

    public function authorize(): bool
    {
        $user = $this->user();
        if (! $user) {
            $this->logUnauthorized('missing_user');
            $this->denyAsNotFound();
        }

        $sessionId = (string) $this->input('session_id');
        if ($sessionId === '') {
            $this->logUnauthorized('missing_session_id');
            $this->denyAsNotFound();
        }

        $sessions = $this->container->make(UploadSessionRepository::class);
        $session = $sessions->get($sessionId);
        if (! $session || $session->userId !== $user->id) {
            $this->logUnauthorized('not_owned_or_missing');
            $this->denyAsNotFound();
        }

        $token = $this->header('X-Upload-Token') ?: $this->input('upload_token');
        if ($token) {
            $tokens = $this->container->make(UploadTokenService::class);
            $payload = $tokens->get((string) $token);
            if (! $payload) {
                $this->logUnauthorized('invalid_token');
                $this->denyAsNotFound();
            }

            if (($payload['session_id'] ?? null) !== $sessionId) {
                $this->logUnauthorized('token_session_mismatch');
                $this->denyAsNotFound();
            }

            if ((int) ($payload['user_id'] ?? 0) !== (int) $user->id) {
                $this->logUnauthorized('token_user_mismatch');
                $this->denyAsNotFound();
            }
        }

        $artworkId = (int) $this->input('artwork_id');
        if ($artworkId <= 0) {
            $this->logUnauthorized('missing_artwork_id');
            $this->denyAsNotFound();
        }

        $artwork = Artwork::query()->find($artworkId);
        if (! $artwork || (int) $artwork->user_id !== (int) $user->id) {
            $this->logUnauthorized('artwork_not_owned_or_missing');
            $this->denyAsNotFound();
        }

        $this->artwork = $artwork;

        return true;
    }

    public function rules(): array
    {
        return [
            'session_id' => 'required|uuid',
            'artwork_id' => 'required|integer',
            'upload_token' => 'nullable|string|min:40|max:200',
        ];
    }

    public function artwork(): Artwork
    {
        if (! $this->artwork) {
            $this->denyAsNotFound();
        }

        return $this->artwork;
    }

    private function denyAsNotFound(): void
    {
        throw new NotFoundHttpException();
    }

    private function logUnauthorized(string $reason): void
    {
        logger()->warning('Upload finish unauthorized access', [
            'reason' => $reason,
            'session_id' => (string) $this->input('session_id'),
            'artwork_id' => $this->input('artwork_id'),
            'user_id' => $this->user()?->id,
            'ip' => $this->ip(),
        ]);
    }
}