@extends('layouts.app')

@section('header')
    <div class="row g-2 align-items-center">
        <div class="col">
            <div class="page-pretitle">
                <a href="{{ route('admin.companies.index') }}" class="text-secondary text-decoration-none">
                    <i class="ti ti-arrow-left me-1"></i>Companies
                </a>
            </div>
            <h2 class="page-title">Microsoft integration — {{ $company->name }}</h2>
            <div class="text-secondary mt-1">
                This company's own Entra tenant. Nothing here is shared with any other company.
            </div>
        </div>
        <div class="col-auto ms-auto">
            @if ($company->ms_verified_at)
                <span class="badge bg-green-lt" title="Entra accepted these credentials — sending still needs the bot account to sign in">
                    <i class="ti ti-check me-1"></i>Credentials OK · {{ $company->ms_verified_at->diffForHumans() }}
                </span>
            @elseif ($configured)
                <span class="badge bg-yellow-lt"><i class="ti ti-help me-1"></i>Not tested yet</span>
            @else
                <span class="badge bg-orange-lt"><i class="ti ti-alert-triangle me-1"></i>Incomplete</span>
            @endif
        </div>
    </div>
@endsection

@section('content')

@foreach (['success' => true, 'warning' => false] as $key => $good)
    @if (session($key))
        <div class="alert alert-{{ $good ? 'success' : 'warning' }} mb-3">
            <i class="ti {{ $good ? 'ti-check' : 'ti-alert-triangle' }} me-1"></i>{{ session($key) }}
        </div>
    @endif
@endforeach

{{-- Step-by-step result of the last ping, held in the flash so it survives the
     redirect back. Absent on a normal page load, which is why the card is not
     rendered as an empty shell. --}}
@if ($ping = session('msPing'))
    <div class="card mb-3">
        <div class="card-header">
            <h3 class="card-title mb-0">Last ping</h3>
            <span class="card-subtitle">{{ number_format($ping['ms']) }}ms</span>
        </div>
        <ul class="list-group list-group-flush">
            @foreach ($ping['steps'] as $step)
                <li class="list-group-item d-flex align-items-start">
                    <i class="ti {{ $step['ok'] ? 'ti-circle-check text-success' : 'ti-circle-x text-danger' }} me-2 mt-1"></i>
                    <div>
                        <div class="fw-semibold">{{ $step['label'] }}</div>
                        <div class="text-secondary">{{ $step['detail'] }}</div>
                    </div>
                </li>
            @endforeach
        </ul>
    </div>
@endif

<div class="row g-3">
    <div class="col-lg-7">
        <form method="POST" action="{{ route('admin.companies.microsoft.update', $company) }}" novalidate>
            @csrf @method('PUT')
            <div class="card">
                <div class="card-header"><h3 class="card-title mb-0">App registration</h3></div>
                <div class="card-body">
                    <div class="mb-3">
                        <label class="form-label">Application (client) ID</label>
                        <input name="ms_client_id" class="form-control font-monospace @error('ms_client_id') is-invalid @enderror"
                               placeholder="00000000-0000-0000-0000-000000000000"
                               value="{{ old('ms_client_id', $company->ms_client_id) }}">
                        @error('ms_client_id')<div class="invalid-feedback">{{ $message }}</div>@enderror
                    </div>

                    <div class="mb-3">
                        <label class="form-label">Directory (tenant) ID</label>
                        <input name="ms_tenant_id" class="form-control font-monospace @error('ms_tenant_id') is-invalid @enderror"
                               placeholder="00000000-0000-0000-0000-000000000000"
                               value="{{ old('ms_tenant_id', $company->ms_tenant_id) }}">
                        <small class="text-secondary">The company's own tenant GUID, or <code>common</code> for a multi-tenant app.</small>
                        @error('ms_tenant_id')<div class="invalid-feedback">{{ $message }}</div>@enderror
                    </div>

                    <div class="mb-3">
                        <label class="form-label">Client secret</label>
                        <input name="ms_client_secret" type="password" autocomplete="new-password"
                               class="form-control @error('ms_client_secret') is-invalid @enderror"
                               placeholder="{{ filled($company->ms_client_secret) ? 'stored — leave blank to keep' : 'paste the secret value' }}">
                        <small class="text-secondary">
                            The secret <em>value</em>, not the secret ID. Encrypted at rest.
                            Leaving this blank keeps the one already stored.
                        </small>
                        @error('ms_client_secret')<div class="invalid-feedback">{{ $message }}</div>@enderror
                    </div>

                    <div class="mb-3">
                        <label class="form-label">Send as</label>
                        <input name="ms_bot_email" type="email" class="form-control @error('ms_bot_email') is-invalid @enderror"
                               placeholder="notifications@company.com"
                               value="{{ old('ms_bot_email', $company->ms_bot_email) }}">
                        <small class="text-secondary">
                            The account Teams messages appear to come from. Optional — the ping
                            checks it resolves in the directory when it is set.
                        </small>
                        @error('ms_bot_email')<div class="invalid-feedback">{{ $message }}</div>@enderror
                    </div>

                    <div class="mb-1">
                        <label class="form-label">Redirect URI</label>
                        <input name="ms_redirect_uri" class="form-control @error('ms_redirect_uri') is-invalid @enderror"
                               placeholder="https://worklance.example.com/login/microsoft/callback"
                               value="{{ old('ms_redirect_uri', $company->ms_redirect_uri) }}">
                        <small class="text-secondary">
                            Only needed for user sign-in. It must match a URI registered on the
                            app registration exactly, host and spelling included.
                        </small>
                        @error('ms_redirect_uri')<div class="invalid-feedback">{{ $message }}</div>@enderror
                    </div>
                </div>
                <div class="card-footer d-flex align-items-center">
                    <span class="text-secondary">Saving clears the verified badge until the next ping.</span>
                    <button class="btn btn-primary ms-auto">Save settings</button>
                </div>
            </div>
        </form>
    </div>

    <div class="col-lg-5">
        <div class="card mb-3">
            <div class="card-header"><h3 class="card-title mb-0">Test the connection</h3></div>
            <div class="card-body">
                <p class="text-secondary">
                    Checks the client ID, secret and tenant against Entra and throws the
                    token away. Read-only: nothing is sent and no message is posted.
                </p>
                <p class="text-secondary">
                    It cannot check Graph access. Every call this integration makes is
                    delegated — made <em>as</em> the sending account — so those permissions
                    only exist once that account has signed in and consented.
                </p>
                <form method="POST" action="{{ route('admin.companies.microsoft.ping', $company) }}">
                    @csrf
                    <button class="btn btn-outline-primary w-100" @disabled(! $configured)>
                        <i class="ti ti-plug-connected me-1"></i> Ping Microsoft
                    </button>
                </form>
                @unless ($configured)
                    <small class="text-secondary d-block mt-2">
                        Client ID, tenant ID and secret must all be saved first.
                    </small>
                @endunless
            </div>
        </div>

        <div class="card">
            <div class="card-header"><h3 class="card-title mb-0">What the tenant needs</h3></div>
            <div class="card-body text-secondary">
                <p>On the customer's app registration, under API permissions — all
                   <strong>delegated</strong>, none needing admin consent:</p>
                <ul class="mb-2">
                    <li><code>openid</code>, <code>profile</code>, <code>email</code> — sign the account in</li>
                    <li><code>offline_access</code> — keep it signed in without a person present</li>
                    <li><code>User.Read</code> — read the sending account's own profile</li>
                    <li><code>User.ReadBasic.All</code> — resolve a recipient by email address</li>
                    <li><code>Chat.Create</code>, <code>Chat.ReadWrite</code>, <code>ChatMessage.Read</code>,
                        <code>ChatMessage.Send</code> — open a 1:1 chat and post to it</li>
                </ul>
                <p class="mb-0">
                    No <strong>application</strong> permissions, and specifically not
                    <code>User.Read.All</code>. An app-only token cannot post to a 1:1 chat
                    as a person, which is the entire point of sending as the bot account.
                </p>
            </div>
        </div>
</div>
@endsection