<?php

namespace App\Models;

use Illuminate\Contracts\Auth\MustVerifyEmail;
use Illuminate\Database\Eloquent\Factories\HasFactory;
use Illuminate\Database\Eloquent\SoftDeletes;
use Illuminate\Foundation\Auth\User as Authenticatable;
use Illuminate\Notifications\Notifiable;
use Laravel\Sanctum\HasApiTokens;
use Spatie\Activitylog\Traits\CausesActivity;
use Spatie\Permission\Traits\HasRoles;

class User extends Authenticatable
{
    use HasApiTokens, HasFactory, HasRoles, Notifiable, SoftDeletes, CausesActivity;

    protected $fillable = [
        'name', 'email', 'password', 'avatar', 'auth_source',
        'ldap_guid', 'ldap_domain', 'is_active', 'mfa_enabled',
        'mfa_secret', 'mfa_recovery_codes', 'last_login_at',
        'last_login_ip', 'preferences',
    ];

    protected $hidden = [
        'password', 'remember_token', 'mfa_secret', 'mfa_recovery_codes',
    ];

    protected $casts = [
        'email_verified_at'   => 'datetime',
        'last_login_at'       => 'datetime',
        'is_active'           => 'boolean',
        'mfa_enabled'         => 'boolean',
        'mfa_recovery_codes'  => 'encrypted:array',
        'mfa_secret'          => 'encrypted',
        'preferences'         => 'array',
        'password'            => 'hashed',
    ];

    public function getAvatarUrlAttribute(): string
    {
        if ($this->avatar) {
            return asset('storage/' . $this->avatar);
        }
        $hash = md5(strtolower(trim($this->email)));
        return "https://www.gravatar.com/avatar/{$hash}?d=identicon&s=128";
    }

    public function isLdapUser(): bool
    {
        return $this->auth_source === 'ldap';
    }

    public function passwordEntries()
    {
        return $this->hasMany(PasswordEntry::class);
    }
}