<?php

namespace App\Support\Auth;

use App\Models\AdminLoginBlock;
use Illuminate\Support\Facades\DB;

class AdminLoginLockout
{
    public const MAX_FAILURES = 4;
    public const BLOCK_MINUTES = 20;

    public static function blockedUntil(string $ip): ?\DateTimeInterface
    {
        $block = AdminLoginBlock::where('ip', $ip)->first();

        return $block?->isBlocked() ? $block->blocked_until : null;
    }

    public static function recordFailure(string $ip, string $username, ?string $userAgent): AdminLoginBlock
    {
        return DB::transaction(function () use ($ip, $username, $userAgent) {
            AdminLoginBlock::query()->insertOrIgnore(['ip' => $ip, 'created_at' => now(), 'updated_at' => now()]);
            $block = AdminLoginBlock::where('ip', $ip)->lockForUpdate()->firstOrFail();

            $windowExpired = $block->last_failed_at === null
                || $block->last_failed_at->lt(now()->subMinutes(self::BLOCK_MINUTES));
            $attempts = ($windowExpired && ! $block->isBlocked() ? 0 : $block->failed_attempts) + 1;

            $block->update([
                'failed_attempts' => $attempts,
                'last_username'   => mb_substr($username, 0, 191),
                'user_agent'      => $userAgent ? mb_substr($userAgent, 0, 500) : null,
                'last_failed_at'  => now(),
                'blocked_until'   => $attempts > self::MAX_FAILURES
                    ? now()->addMinutes(self::BLOCK_MINUTES)
                    : $block->blocked_until,
            ]);

            return $block;
        });
    }

    public static function remainingAttempts(AdminLoginBlock $block): int
    {
        return max(0, self::MAX_FAILURES + 1 - $block->failed_attempts);
    }
}