defmodule CentralcloudOps.SessionController do
  use Phoenix.Controller, formats: [:html]
  import Plug.Conn

  def new(conn, _params) do
    conn
    |> put_resp_content_type("text/html")
    |> send_resp(200, login_page(conn))
  end

  def create(conn, %{"username" => _username, "password" => _password}) do
    # TODO: validate against Authentik / staff directory
    conn
    |> put_flash(:error, "Invalid credentials")
    |> redirect(to: "/login")
  end

  def delete(conn, _params) do
    conn
    |> clear_session()
    |> redirect(to: "/login")
  end

  def oidc_callback(conn, params) do
    # TODO: exchange code with Authentik, verify staff group membership, set session
    _ = params
    conn
    |> put_flash(:info, "SSO login coming soon")
    |> redirect(to: "/login")
  end

  defp login_page(conn) do
    csrf = Phoenix.Controller.get_csrf_token()
    flash_error = Phoenix.Flash.get(conn.assigns[:flash] || %{}, :error)

    """
    <!DOCTYPE html>
    <html lang="en">
    <head>
      <meta charset="utf-8"/>
      <meta name="viewport" content="width=device-width, initial-scale=1"/>
      <meta name="csrf-token" content="#{csrf}"/>
      <title>Sign in — CentralCloud Ops</title>
      <style>
        * { box-sizing: border-box; margin: 0; padding: 0; }
        body { font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
               background: #0a0f1e; color: #e2e8f0; display: flex;
               align-items: center; justify-content: center; min-height: 100vh; }
        .card { background: #0f1629; border: 1px solid #1e3a5f; border-radius: 12px;
                padding: 2.5rem; width: 100%; max-width: 380px; }
        h1 { font-size: 1.4rem; font-weight: 700; color: #f97316; margin-bottom: 0.25rem; }
        p.sub { color: #64748b; font-size: 0.85rem; margin-bottom: 2rem; }
        label { display: block; font-size: 0.8rem; color: #64748b; margin-bottom: 0.3rem; }
        input { width: 100%; padding: 0.6rem 0.8rem; background: #0a0f1e;
                border: 1px solid #1e3a5f; border-radius: 6px; color: #e2e8f0;
                font-size: 0.9rem; margin-bottom: 1rem; }
        button { width: 100%; padding: 0.7rem; background: #f97316; border: none;
                 border-radius: 6px; color: #fff; font-weight: 600; cursor: pointer;
                 font-size: 0.95rem; }
        button:hover { background: #fb923c; }
        .divider { text-align: center; color: #334155; font-size: 0.8rem; margin: 1rem 0; }
        .sso { width: 100%; padding: 0.7rem; background: #0a0f1e; border: 1px solid #1e3a5f;
               border-radius: 6px; color: #e2e8f0; font-size: 0.9rem; cursor: pointer;
               text-align: center; text-decoration: none; display: block; }
        .sso:hover { border-color: #f97316; }
        .error { background: #4c0519; border: 1px solid #dc2626; border-radius: 6px;
                 padding: 0.6rem 0.8rem; font-size: 0.85rem; margin-bottom: 1rem; }
      </style>
    </head>
    <body>
      <div class="card">
        <h1>🔥 CentralCloud Ops</h1>
        <p class="sub">Staff portal — sign in to continue</p>
        #{if flash_error, do: "<div class='error'>#{flash_error}</div>", else: ""}
        <form method="post" action="/login">
          <input type="hidden" name="_csrf_token" value="#{csrf}"/>
          <label>Username</label>
          <input type="text" name="username" autocomplete="username" required/>
          <label>Password</label>
          <input type="password" name="password" autocomplete="current-password" required/>
          <button type="submit">Sign in</button>
        </form>
        <div class="divider">or</div>
        <a class="sso" href="/auth/callback">🔐 Sign in with CentralCloud SSO</a>
      </div>
    </body>
    </html>
    """
  end
end
