<?php

namespace App\Http\Controllers\Auth;  

use App\Http\Controllers\Controller;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Session;
use Illuminate\Support\Facades\Mail;
use Illuminate\Support\Facades\Hash;
use App\Mail\OtpEmail;
use App\Models\User;

class ForgotPasswordController extends Controller  
{
    public function index()
    {
        return view('forgotPassword');
    }

    public function resetEmail(Request $request)
    {
        $request->validate([
            'email' => 'required|email|exists:users,email'
        ], [
            'email.exists' => 'The provided email is not registered in our system.'
        ]);

        $email = $request->input('email');
        $user = User::where('email', $email)->first();

        $otp = random_int(100000, 999999);

        Session::put('otp', $otp);
        Session::put('email', $email);

        $user->email_otp = $otp;
        $user->save();

        Mail::to($email)->send(new OtpEmail($otp));

        return response()->json([
            'success' => true, 
            'message' => 'OTP has been sent to your email.'
        ]);
    }

   
    
    public function verifyOtpEmail(Request $request)
    {
        $request->validate([
            'otp' => 'required|numeric'
        ]);

        $otp = $request->input('otp');
        $email = Session::get('email');

        if (!$email) {
            return response()->json([
                'success' => false, 
                'message' => 'Session expired. Please request a new OTP.'
            ], 400);
        }

        $user = User::where('email', $email)
                    ->where('email_otp', $otp)
                    ->first();

        if ($user) {
            Session::put('otp_verified', true);

            return response()->json([
                'success' => true, 
                'message' => 'OTP is correct.', 
                'email'   => $email
            ]);
        }

        return response()->json([
            'success' => false, 
            'message' => 'Invalid OTP code. Please try again.'
        ], 422);
    }

    public function updatePassword(Request $request)
    {
        $request->validate([
            'email'       => 'required|email|exists:users,email',
            'password_mo' => 'required|string|min:8|confirmed',
        ]);

        $email = $request->input('email');
        
        if (!Session::get('otp_verified') || Session::get('email') !== $email) {
            return redirect()->back()->with('error', 'Unauthorized access or session expired.');
        }

        $user = User::where('email', $email)->first();

        if ($user) {
            $user->password = Hash::make($request->input('password_mo'));
            $user->email_otp = null;
            $user->save();

            Session::forget(['otp', 'email', 'otp_verified']);

            return redirect('/signin')->with('success', 'Password updated successfully. Please login.');
        }

        return redirect()->back()->with('error', 'User not found.');
    }
}