<?php

namespace Modules\Bms\Database\Seeders;

use App\Business;
use App\User;
use Illuminate\Database\Seeder;
use Illuminate\Support\Facades\Hash;
use Spatie\Permission\Models\Permission;
use Spatie\Permission\Models\Role;

/**
 * Seeds demo BMS staff with distinct roles/permission sets so RBAC can be
 * tested in the employee PWA. Idempotent. Re-runnable. Test data only —
 * gated behind config('bms.test_login') in the dev sign-in endpoint.
 */
class BmsTestStaffSeeder extends Seeder
{
    public const PASSWORD = 'Banquet@123';

    /** role key => [label_en, label_ar, [bms permissions]] */
    public const ROLES = [
        'sales' => ['Sales agent', 'مندوب مبيعات', [
            'bms.access', 'bms.dashboard.view', 'bms.leads.view', 'bms.leads.manage',
            'bms.bookings.view', 'bms.halls.view',
        ]],
        'finance' => ['Finance', 'محاسب', [
            'bms.access', 'bms.dashboard.view', 'bms.bookings.view', 'bms.bookings.manage',
        ]],
        'operations' => ['Operations', 'عمليات', [
            'bms.access', 'bms.dashboard.view', 'bms.bookings.view', 'bms.assets.view',
            'bms.maintenance.view', 'bms.maintenance.manage', 'bms.qc.view', 'bms.qc.manage',
        ]],
        'manager' => ['Banquet manager', 'مدير القاعات', [
            'bms.access', 'bms.dashboard.view', 'bms.leads.view', 'bms.leads.manage',
            'bms.bookings.view', 'bms.bookings.manage', 'bms.bookings.cancel', 'bms.bookings.override_penalty',
            'bms.halls.view', 'bms.assets.view', 'bms.maintenance.view', 'bms.maintenance.manage',
            'bms.qc.view', 'bms.qc.manage', 'bms.ai.use', 'bms.settings.access',
        ]],
    ];

    public function run(): void
    {
        $this->ensure((int) Business::min('id'));
    }

    /**
     * Ensure the four test staff exist for a business. Returns
     * [roleKey => ['username','name','name_ar']] for the dev sign-in UI.
     */
    public static function ensure(int $businessId): array
    {
        $out = [];
        foreach (self::ROLES as $key => [$labelEn, $labelAr, $perms]) {
            // Permissions exist (guard web).
            foreach ($perms as $p) {
                Permission::firstOrCreate(['name' => $p, 'guard_name' => 'web']);
            }

            // Role per business: "BMS <Label>#<biz>".
            $roleName = 'BMS ' . $labelEn . '#' . $businessId;
            $role = Role::firstOrCreate(
                ['name' => $roleName],
                ['business_id' => $businessId, 'guard_name' => 'web', 'is_default' => 0]
            );
            $role->syncPermissions($perms);

            // User.
            $username = 'bms_' . $key;
            $user = User::where('username', $username)->first();
            if (! $user) {
                $user = new User();
                $user->username = $username;
                $user->first_name = $labelEn;
                $user->surname = '(demo)';
                $user->business_id = $businessId;
                $user->user_type = 'user';
                $user->language = 'en';
            }
            $user->password = Hash::make(self::PASSWORD);
            $user->status = 'active';
            $user->allow_login = 1;
            $user->save();
            $user->syncRoles([$role->name]);

            $out[$key] = ['username' => $username, 'name' => $labelEn, 'name_ar' => $labelAr];
        }

        return $out;
    }
}
