<?php

namespace App\Models\User;

// use Illuminate\Contracts\Auth\MustVerifyEmail;
use App\Interface\HistoryOwner;
use App\Interface\NoteOwner;
use App\Trait\HasHistory;
use App\Trait\HasNotes;
use App\Trait\HasSlug;
use Illuminate\Database\Eloquent\Factories\HasFactory;
use Illuminate\Foundation\Auth\User as Authenticatable;
use Illuminate\Notifications\Notifiable;
use Laravel\Fortify\TwoFactorAuthenticatable;
use Laravel\Jetstream\HasProfilePhoto;
use Laravel\Sanctum\HasApiTokens;
use Spatie\Permission\Traits\HasRoles;

class User extends Authenticatable implements HistoryOwner, NoteOwner {
    use HasApiTokens;
    use HasHistory;
    use HasNotes;
    use HasSlug;
    use HasFactory;
    use HasProfilePhoto;
    use Notifiable;
    use HasRoles;
    use TwoFactorAuthenticatable;

    /**
     * The attributes that are mass assignable.
     *
     * @var array<int, string>
     */
    protected $fillable = [
        'name_first',
        'name_last',
        'username',
        'email_address',
        'password',
        'allowed_workspaces',
    ];

    /**
     * The attributes that should be hidden for serialization.
     *
     * @var array<int, string>
     */
    protected $hidden = [
        'password',
        'remember_token',
        'two_factor_recovery_codes',
        'two_factor_secret',
    ];

    /**
     * The accessors to append to the model's array form.
     *
     * @var array<int, string>
     */
    protected $appends = [
        'profile_photo_url',
    ];

    /**
     * Get the attributes that should be cast.
     *
     * @return array<string, string>
     */
    protected function casts(): array {
        return [
            'email_verified_at'  => 'datetime',
            'password'           => 'hashed',
            'allowed_workspaces' => 'array',
        ];
    }

    /**
     * Whether this user can access a given workspace.
     *
     * Returns true when:
     *  - the user holds the workspaces.override permission, OR
     *  - allowed_workspaces is null (unrestricted), OR
     *  - the workspace appears in the allowed_workspaces whitelist.
     */
    public function canAccessWorkspace(string $workspace): bool
    {
        if ($this->hasPermissionTo('workspaces.override')) {
            return true;
        }

        if ($this->allowed_workspaces === null) {
            return true;
        }

        return in_array($workspace, $this->allowed_workspaces, true);
    }
}
