<?php

namespace App\Models;

use Illuminate\Database\Eloquent\Relations\BelongsTo;

class UserSecurity extends BaseModel
{
    /**
     * The table associated with the model.
     */
    protected $table = 'repo_user_security';

    /**
     * The primary key for the model.
     */
    protected $primaryKey = 'user_id';

    /**
     * Indicates if the IDs are auto-incrementing.
     */
    public $incrementing = false;

    /**
     * The attributes that are mass assignable.
     */
    protected $fillable = [
        'user_id',
        'verification_token',
        'password_reset_token',
        'two_factor_secret',
        'two_factor_enabled',
        'login_attempts',
        'last_login_at',
        'locked_until',
        'password_reset_expires_at',
        'jwt_token'
    ];

    /**
     * The attributes that should be hidden for serialization.
     * Security-sensitive data and all ID fields
     */
    protected $hidden = [
        'id',
        'user_id',
        'verification_token',
        'password_reset_token',
        'two_factor_secret',
        'jwt_token',
        'company_id',
        'role_id',
        'report_id',
        'module_id'
    ];

    /**
     * The attributes that should be cast to native types.
     */
    protected $casts = [
        'password_reset_expires_at' => 'datetime',
        'updated_at' => 'datetime',
    ];

    /**
     * Get the user that owns the security record.
     */
    public function user(): BelongsTo
    {
        return $this->belongsTo(User::class, 'user_id', 'user_id');
    }

    /**
     * Check if password reset token is valid.
     */
    public function isPasswordResetTokenValid(): bool
    {
        return $this->password_reset_token && 
               $this->password_reset_expires_at && 
               $this->password_reset_expires_at->isFuture();
    }

    /**
     * Generate new verification token.
     */
    public function generateVerificationToken(): string
    {
        $this->verification_token = bin2hex(random_bytes(32));
        $this->save();
        return $this->verification_token;
    }

    /**
     * Generate new password reset token.
     */
    public function generatePasswordResetToken(int $expiryHours = 24): string
    {
        $this->password_reset_token = bin2hex(random_bytes(32));
        $this->password_reset_expires_at = now()->addHours($expiryHours);
        $this->save();
        return $this->password_reset_token;
    }

    /**
     * Clear verification token.
     */
    public function clearVerificationToken(): void
    {
        $this->verification_token = null;
        $this->save();
    }

    /**
     * Clear password reset token.
     */
    public function clearPasswordResetToken(): void
    {
        $this->password_reset_token = null;
        $this->password_reset_expires_at = null;
        $this->save();
    }
}