portal-api/app/Http/Controllers/Api/Admin/Setting/SettingController.php

<?php

declare(strict_types=1);

namespace App\Http\Controllers\Api\Admin\Setting;

use App\Http\Controllers\Controller;
use App\Http\Facade\SignRSA;
use App\Http\Services\Telegram;
use App\Models\Setting;
use App\Support\PublicSetting;
use App\Support\MailSettings;
use App\Support\Turnstile;
use Illuminate\Http\JsonResponse;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Cache;
use Illuminate\Support\Facades\Storage;
use Illuminate\Support\Facades\Validator;

class SettingController extends Controller
{
    /**
     * GET /administrator/settings
     * Returns all setting keys: setting, smtp.
     */
    public function index(): JsonResponse
    {
        $setting = Setting::where('key', 'setting')->first();
        $smtp    = Setting::where('key', 'smtp')->first();

        $settingValue = $setting ? json_decode((string) $setting->value, true) : [];
        $smtpValue    = $smtp    ? json_decode((string) $smtp->value, true)    : [];

        // Never expose raw smtp password
        if (isset($smtpValue['password']) && !empty($smtpValue['password'])) {
            $smtpValue['password'] = '********';
        }

        return response()->json([
            'error' => false,
            'data'  => [
                'setting' => $settingValue,
                'smtp'    => $smtpValue,
                'turnstile' => Turnstile::forAdmin(),
            ],
        ]);
    }

    /**
     * GET /settings/public
     * Không cần token — chỉ trả các field công khai dùng cho trang đăng nhập.
     */
    public function public(): JsonResponse
    {
        return response()->json([
            'error' => false,
            'data'  => PublicSetting::values() + ['turnstile_site_key' => Turnstile::siteKey()],
        ]);
    }

    /**
     * PUT /administrator/settings
     * Accepts: { setting: {...}, smtp: {...} }
     */
    public function update(Request $request): JsonResponse
    {
        $validator = Validator::make($request->all(), [
            'setting'               => 'sometimes|array',
            'setting.api_inet'      => 'sometimes|string|nullable',
            'setting.require_complete_profile' => 'sometimes|boolean',
            'smtp'                  => 'sometimes|array',
            'smtp.host'             => 'sometimes|string',
            'smtp.port'             => 'sometimes|integer',
            'smtp.user'             => 'sometimes|email',
            'smtp.encryption'       => 'sometimes|in:ssl,tls,starttls,',
            'smtp.from_name'        => 'sometimes|string|nullable',
            'smtp.from_address'     => 'sometimes|email|nullable',
            'turnstile'             => 'sometimes|array',
            'turnstile.enabled'     => 'sometimes|boolean',
            'turnstile.site_key'    => 'sometimes|string|nullable|max:255',
            'turnstile.secret_key'  => 'sometimes|string|nullable|max:255',
        ]);

        if ($validator->fails()) {
            return response()->json(['error' => true, 'message' => $validator->errors()->first()], 422);
        }

        if ($request->has('setting')) {
            $current = Setting::where('key', 'setting')->first();
            $existing = $current ? json_decode((string) $current->value, true) : [];
            $merged   = array_merge($existing, $request->input('setting'));

            Setting::updateOrCreate(
                ['key' => 'setting'],
                ['value' => json_encode($merged, JSON_UNESCAPED_UNICODE)]
            );
        }

        if ($request->has('smtp')) {
            $smtpData = $request->input('smtp');
            $current  = Setting::where('key', 'smtp')->first();
            $existing = $current ? json_decode((string) $current->value, true) : [];

            // Keep existing password if placeholder sent (not changed)
            if (isset($smtpData['password']) && $smtpData['password'] === '********') {
                $smtpData['password'] = $existing['password'] ?? '';
            } elseif (isset($smtpData['password']) && !empty($smtpData['password'])) {
                $smtpData['password'] = SignRSA::EncryptFunc($smtpData['password']);
            }

            $merged = array_merge($existing, $smtpData);

            Setting::updateOrCreate(
                ['key' => 'smtp'],
                ['value' => json_encode($merged, JSON_UNESCAPED_UNICODE)]
            );

            Cache::forget(MailSettings::cacheKey());
        }

        if ($request->has('turnstile')) {
            try {
                Turnstile::save($request->input('turnstile'));
            } catch (\InvalidArgumentException $e) {
                return response()->json(['error' => true, 'message' => $e->getMessage()], 422);
            }
        }

        return response()->json([
            'error'   => false,
            'message' => 'Cập nhật cài đặt thành công.',
        ]);
    }

    /**
     * GET /administrator/vat-settings
     * Returns saved VAT rates per service type.
     */
    public function vatIndex(): JsonResponse
    {
        $row  = Setting::where('key', 'vat_settings')->first();
        $data = $row ? json_decode((string) $row->value, true) : [];

        return response()->json(['error' => false, 'data' => is_array($data) ? $data : []]);
    }

    /**
     * PUT /administrator/vat-settings
     * Accepts: { settings: [{ type, type_label, vat_rate }] }
     */
    public function vatUpdate(Request $request): JsonResponse
    {
        $validator = Validator::make($request->all(), [
            'settings'              => 'required|array',
            'settings.*.type'       => 'required|string',
            'settings.*.type_label' => 'sometimes|string|nullable',
            'settings.*.vat_rate'   => 'required|numeric|min:0|max:100',
        ]);

        if ($validator->fails()) {
            return response()->json(['error' => true, 'message' => $validator->errors()->first()], 422);
        }

        Setting::updateOrCreate(
            ['key' => 'vat_settings'],
            ['value' => json_encode($request->input('settings'), JSON_UNESCAPED_UNICODE)]
        );

        return response()->json(['error' => false, 'message' => 'Cập nhật thuế VAT thành công.']);
    }

    /**
     * POST /administrator/settings/test-telegram
     * Sends a test message using the currently saved Telegram config.
     */
    public function testTelegram(): JsonResponse
    {
        $response = (new Telegram())->SendMessage('🔔 Đây là tin nhắn test từ Portal Admin — cấu hình Telegram đang hoạt động!');

        if (!$response || !$response->successful()) {
            return response()->json([
                'error'   => true,
                'message' => $response
                    ? 'Telegram trả về lỗi: ' . $response->body()
                    : 'Chưa cấu hình đủ Bot Token / Bot ID.',
            ], 422);
        }

        return response()->json(['error' => false, 'message' => 'Đã gửi tin nhắn test thành công.']);
    }

    public function uploadMedia(Request $request): JsonResponse
    {
        $request->validate([
            'file' => 'required|file|mimes:jpg,jpeg,png,webp|max:5120',
        ]);

        $path = $request->file('file')->store('system-config', 'public');

        return response()->json([
            'error' => false,
            'url' => Storage::disk('public')->url($path),
            'path' => $path,
        ]);
    }
}