<?php
declare(strict_types=1);

namespace app\adminapi\controller\identity;

use app\adminapi\controller\BaseAdminController;
use app\adminapi\service\IdentitySessionService;
use app\adminapi\validate\LoginValidate;
use app\common\enum\AdminTerminalEnum;
use app\common\service\JsonService;

/** 独立账号后台的个人会话接口，服务内部始终核验真实数据库会话。 */
class SessionController extends BaseAdminController
{
    // 首次改密/待绑定企微时也必须可用；这里仅跳过旧门禁，绝不跳过服务内认证。
    public array $notNeedLogin = ['login', 'verify', 'password', 'logout'];

    public function verify()
    {
        if (!$this->request->isPost()) {
            return JsonService::fail('请使用POST请求');
        }
        $params = $this->request->post();
        if (array_diff(array_keys($params), ['account', 'password']) !== []
            || !is_string($params['account'] ?? null) || $params['account'] === '' || strlen($params['account']) > 4096
            || str_contains($params['account'], "\0") || !is_string($params['password'] ?? null)
            || $params['password'] === '' || strlen($params['password']) > 4096 || str_contains($params['password'], "\0")) {
            return JsonService::fail('登录参数不合法');
        }
        $params = (new LoginValidate())->post()->goCheck('verify');
        return $this->data(IdentitySessionService::verify($params));
    }

    public function login()
    {
        if (!$this->request->isPost()) {
            return JsonService::fail('请使用POST请求');
        }
        // 专用集团终端只在此入口接受；不扩大普通网页登录的终端白名单。
        $terminal = $this->request->post('terminal');
        $groupSession = in_array($terminal, [AdminTerminalEnum::GROUP_IDENTITY, (string) AdminTerminalEnum::GROUP_IDENTITY], true);
        // verify 场景保留原限流并禁用调试免密；服务仍在账号锁内校验全部参数与当前密码。
        $params = (new LoginValidate())->post()->goCheck($groupSession ? 'verify' : null);
        return $this->data(IdentitySessionService::login($params));
    }

    public function password()
    {
        if (!$this->request->isPost()) {
            return JsonService::fail('请使用POST请求');
        }
        IdentitySessionService::changePassword((string) $this->request->header('token', ''), $this->request->post());
        return $this->success('密码修改成功，请重新登录');
    }

    public function logout()
    {
        if (!$this->request->isPost()) {
            return JsonService::fail('请使用POST请求');
        }
        $params = $this->request->post();
        if (array_diff(array_keys($params), ['all']) !== [] || !in_array($params['all'] ?? 0, [0, 1, '0', '1'], true)) {
            return JsonService::fail('退出参数不合法');
        }
        IdentitySessionService::logout((string) $this->request->header('token', ''), (int) ($params['all'] ?? 0) === 1);
        return $this->success('已退出登录');
    }
}