<?php

declare(strict_types=1);

namespace App\Services;

use App\Http\Facade\SignRSA;
use App\Models\ModuleVmware;
use Illuminate\Support\Facades\Log;

final class VmProvisionService
{
    public const OS_LINUX   = 'LINUX';
    public const OS_WINDOWS = 'WINDOWS';

    /** Default password baked into every VM template */
    public static function templatePassword(): string
    {
        return config('vmware.template_password');
    }

    // -------------------------------------------------------------------------
    // Password
    // -------------------------------------------------------------------------

    /**
     * Generate a cryptographically secure 16-char password.
     * Charset deliberately excludes % (breaks cmd.exe env expansion)
     * and " (breaks PowerShell argument quoting).
     */
    public function generatePassword(int $length = 16): string
    {
        $sets = [
            'ABCDEFGHJKLMNPQRSTUVWXYZ',
            'abcdefghjkmnpqrstuvwxyz',
            '23456789',
            '!@#$*',  // no % or " — safe in cmd.exe double-quoted arguments
        ];

        $password = '';
        $allChars = implode('', $sets);

        foreach ($sets as $set) {
            $password .= $set[random_int(0, strlen($set) - 1)];
        }

        for ($i = count($sets); $i < $length; $i++) {
            $password .= $allChars[random_int(0, strlen($allChars) - 1)];
        }

        $chars = str_split($password);
        for ($i = count($chars) - 1; $i > 0; $i--) {
            $j = random_int(0, $i);
            [$chars[$i], $chars[$j]] = [$chars[$j], $chars[$i]];
        }

        return implode('', $chars);
    }

    public function encryptPassword(string $plaintext): string
    {
        return SignRSA::EncryptFunc($plaintext);
    }

    // -------------------------------------------------------------------------
    // Persistence
    // -------------------------------------------------------------------------

    /**
     * Update password only — IP already set during VM creation.
     */
    public function updatePassword(int $moduleVmwareId, string $plainPassword): void
    {
        ModuleVmware::findOrFail($moduleVmwareId)->update([
            'password'       => $this->encryptPassword($plainPassword),
            'plain_password' => $plainPassword,
        ]);

        Log::info('VmProvisionService::updatePassword saved', [
            'module_vmware_id' => $moduleVmwareId,
        ]);
    }
}