<?php

class User
{
    private PDO $pdo;

    public function __construct(Database $db)
    {
        $this->pdo = $db->getConnection();
    }

    public function all(): array
    {
        $stmt = $this->pdo->query("SELECT * FROM users ORDER BY first_name ASC, last_name ASC");
        return $stmt->fetchAll();
    }

    public function find(int $id): ?array
    {
        $stmt = $this->pdo->prepare("SELECT * FROM users WHERE id = :id");
        $stmt->execute(['id' => $id]);
        $row = $stmt->fetch();
        return $row !== false ? $row : null;
    }

    public function emailExists(string $email, ?int $excludeId = null): bool
    {
        if ($excludeId !== null) {
            $stmt = $this->pdo->prepare("SELECT id FROM users WHERE email = :e AND id <> :id");
            $stmt->execute(['e' => $email, 'id' => $excludeId]);
        } else {
            $stmt = $this->pdo->prepare("SELECT id FROM users WHERE email = :e");
            $stmt->execute(['e' => $email]);
        }
        return (bool)$stmt->fetch();
    }

    public function create(array $data): int
    {
        $sql = "INSERT INTO users (email, password, first_name, last_name, role, status)
                VALUES (:email, :password, :first_name, :last_name, :role, :status)";
        $stmt = $this->pdo->prepare($sql);
        $stmt->execute([
            'email'      => $data['email'],
            'password'   => password_hash((string)$data['password'], PASSWORD_BCRYPT),
            'first_name' => $data['first_name'],
            'last_name'  => $data['last_name'],
            'role'       => $data['role'],
            'status'     => $data['status'] ?? 'active',
        ]);
        return (int)$this->pdo->lastInsertId();
    }

    public function update(int $id, array $data): bool
    {
        if (!empty($data['password'])) {
            $sql = "UPDATE users SET
                      email = :email, first_name = :first_name, last_name = :last_name,
                      role = :role, status = :status, password = :password
                    WHERE id = :id";
            $stmt = $this->pdo->prepare($sql);
            return $stmt->execute([
                'email'      => $data['email'],
                'first_name' => $data['first_name'],
                'last_name'  => $data['last_name'],
                'role'       => $data['role'],
                'status'     => $data['status'] ?? 'active',
                'password'   => password_hash((string)$data['password'], PASSWORD_BCRYPT),
                'id'         => $id,
            ]);
        }
        $sql = "UPDATE users SET
                  email = :email, first_name = :first_name, last_name = :last_name,
                  role = :role, status = :status
                WHERE id = :id";
        $stmt = $this->pdo->prepare($sql);
        return $stmt->execute([
            'email'      => $data['email'],
            'first_name' => $data['first_name'],
            'last_name'  => $data['last_name'],
            'role'       => $data['role'],
            'status'     => $data['status'] ?? 'active',
            'id'         => $id,
        ]);
    }

    public function delete(int $id): bool
    {
        $stmt = $this->pdo->prepare("DELETE FROM users WHERE id = :id");
        return $stmt->execute(['id' => $id]);
    }

    public static function validate(array $data, bool $isCreate): array
    {
        $errors = [];
        foreach (['first_name' => 'Vorname', 'last_name' => 'Nachname', 'email' => 'E-Mail', 'role' => 'Rolle'] as $f => $l) {
            if (empty(trim((string)($data[$f] ?? '')))) {
                $errors[$f] = $l . ' ist erforderlich.';
            }
        }
        if (!empty($data['email']) && !filter_var($data['email'], FILTER_VALIDATE_EMAIL)) {
            $errors['email'] = 'Gültige E-Mail-Adresse angeben.';
        }
        if (!empty($data['role']) && !in_array($data['role'], Permission::ROLES, true)) {
            $errors['role'] = 'Ungültige Rolle.';
        }
        if ($isCreate || !empty($data['password'])) {
            if (empty($data['password']) || strlen($data['password']) < 6) {
                $errors['password'] = 'Passwort muss mindestens 6 Zeichen lang sein.';
            }
        }
        return $errors;
    }
}