<?php

namespace App\Services;

use App\Models\Tenant;
use App\Models\User;
use Illuminate\Support\Facades\DB;
use Illuminate\Support\Facades\Schema;

/** Diagnostic only: reads exactly the authority sources used by activation. */
class OrganizationActivationPreview
{
    /** @return array<string,mixed> */
    public function build(User $actor): array
    {
        $configuration = app(OrganizationConfiguration::class);
        $actor = $configuration->administrator($actor);
        $ready = Schema::hasTable('organization_access') && Schema::hasTable('organization_profiles') && Schema::hasTable('organization_memberships');
        if (! $ready) {
            return ['ready' => false, 'users' => []];
        }
        $access = app(OrganizationAccess::class);
        $context = app(WorkContext::class);
        $company = Tenant::query()->findOrFail($actor->tenant_id);
        $admins = $configuration->permanentAdministrators($actor->tenant_id);
        $active = $access->active($actor->tenant_id);
        $users = [];
        foreach (User::query()->where('tenant_id', $actor->tenant_id)->orderBy('name')->orderBy('id')->get() as $user) {
            $current = $access->permissions($user);
            $configured = $access->configuredPermissions($user);
            $enforced = $context->enforced($user);
            $users[] = ['id' => $user->id, 'name' => $user->name, 'current_permissions' => $current, 'configured_permissions' => $configured,
                'added' => array_values(array_diff($configured, $current)), 'removed' => array_values(array_diff($current, $configured)),
                'current_can_request' => $access->canRequest($user), 'configured_can_request' => in_array('requester', $configured, true),
                'configured_maintenance_only' => $access->configuredMaintenanceOnly($user), 'permanent_admin' => in_array($user->id, $admins, true),
                'current_contexts' => $enforced ? $context->available($user) : null,
                'configured_contexts' => $enforced ? $context->configuredAvailable($user) : null,
                'loses_access' => $current !== [] && $configured === []];
        }

        return ['ready' => true, 'active' => $active, 'version' => DB::table('organization_access')->where('tenant_id', $actor->tenant_id)->value('version') ?? 1,
            'checked_at' => now()->toIso8601String(), 'users' => $users, 'permanent_administrators' => count($admins),
            'provisional_rules' => $company->rules_provisional, 'can_activate' => ! $active && count($admins) >= 2 && ! $company->rules_provisional,
            'losing_access' => count(array_filter($users, fn ($row) => $row['loses_access'])),
            'context_labels' => array_map(fn ($option) => $option['areaLabel'].' · '.$option['label'], WorkContext::OPTIONS)];
    }
}