@extends('layouts.app')

@section('header')
    <div class="row g-2 align-items-center">
        <div class="col">
            <div class="page-pretitle">
                <a href="{{ route('admin.companies.index') }}" class="text-secondary text-decoration-none">
                    <i class="ti ti-arrow-left me-1"></i>Companies
                </a>
            </div>
            <h2 class="page-title">Microsoft integration — {{ $company->name }}</h2>
            <div class="text-secondary mt-1">
                This company's own Entra tenant. Nothing here is shared with any other company.
            </div>
        </div>
        <div class="col-auto ms-auto">
            @if ($company->ms_verified_at)
                <span class="badge bg-green-lt" title="Entra accepted these credentials — sending still needs the bot account to sign in">
                    <i class="ti ti-check me-1"></i>Credentials OK · {{ $company->ms_verified_at->diffForHumans() }}
                </span>
            @elseif ($configured)
                <span class="badge bg-yellow-lt"><i class="ti ti-help me-1"></i>Not tested yet</span>
            @else
                <span class="badge bg-orange-lt"><i class="ti ti-alert-triangle me-1"></i>Incomplete</span>
            @endif
        </div>
    </div>
@endsection

@section('content')

@foreach (['success' => true, 'warning' => false] as $key => $good)
    @if (session($key))
        <div class="alert alert-{{ $good ? 'success' : 'warning' }} mb-3">
            <i class="ti {{ $good ? 'ti-check' : 'ti-alert-triangle' }} me-1"></i>{{ session($key) }}
        </div>
    @endif
@endforeach

{{-- Step-by-step result of the last ping, held in the flash so it survives the
     redirect back. Absent on a normal page load, which is why the card is not
     rendered as an empty shell. --}}
@if ($ping = session('msPing'))
    <div class="card mb-3">
        <div class="card-header">
            <h3 class="card-title mb-0">Last ping</h3>
            <span class="card-subtitle">{{ number_format($ping['ms']) }}ms</span>
        </div>
        <ul class="list-group list-group-flush">
            @foreach ($ping['steps'] as $step)
                <li class="list-group-item d-flex align-items-start">
                    <i class="ti {{ $step['ok'] ? 'ti-circle-check text-success' : 'ti-circle-x text-danger' }} me-2 mt-1"></i>
                    <div>
                        <div class="fw-semibold">{{ $step['label'] }}</div>
                        <div class="text-secondary">{{ $step['detail'] }}</div>
                    </div>
                </li>
            @endforeach
        </ul>
    </div>
@endif

<div class="row g-3">
    <div class="col-lg-7">
        <form method="POST" action="{{ route('admin.companies.microsoft.update', $company) }}" novalidate>
            @csrf @method('PUT')
            <div class="card">
                <div class="card-header"><h3 class="card-title mb-0">App registration</h3></div>
                <div class="card-body">
                    <div class="mb-3">
                        <label class="form-label">Application (client) ID</label>
                        <input name="ms_client_id" class="form-control font-monospace @error('ms_client_id') is-invalid @enderror"
                               placeholder="00000000-0000-0000-0000-000000000000"
                               value="{{ old('ms_client_id', $company->ms_client_id) }}">
                        @error('ms_client_id')<div class="invalid-feedback">{{ $message }}</div>@enderror
                    </div>

                    <div class="mb-3">
                        <label class="form-label">Directory (tenant) ID</label>
                        <input name="ms_tenant_id" class="form-control font-monospace @error('ms_tenant_id') is-invalid @enderror"
                               placeholder="00000000-0000-0000-0000-000000000000"
                               value="{{ old('ms_tenant_id', $company->ms_tenant_id) }}">
                        <small class="text-secondary">The company's own tenant GUID, or <code>common</code> for a multi-tenant app.</small>
                        @error('ms_tenant_id')<div class="invalid-feedback">{{ $message }}</div>@enderror
                    </div>

                    <div class="mb-3">
                        <label class="form-label">Client secret</label>
                        <input name="ms_client_secret" type="password" autocomplete="new-password"
                               class="form-control @error('ms_client_secret') is-invalid @enderror"
                               placeholder="{{ filled($company->ms_client_secret) ? 'stored — leave blank to keep' : 'paste the secret value' }}">
                        <small class="text-secondary">
                            The secret <em>value</em>, not the secret ID. Encrypted at rest.
                            Leaving this blank keeps the one already stored.
                        </small>
                        @error('ms_client_secret')<div class="invalid-feedback">{{ $message }}</div>@enderror
                    </div>

                    <div class="mb-3">
                        <label class="form-label">Send as</label>
                        <input name="ms_bot_email" type="email" class="form-control @error('ms_bot_email') is-invalid @enderror"
                               placeholder="notifications@company.com"
                               value="{{ old('ms_bot_email', $company->ms_bot_email) }}">
                        <small class="text-secondary">
                            The account Teams messages appear to come from. Optional — the ping
                            checks it resolves in the directory when it is set.
                        </small>
                        @error('ms_bot_email')<div class="invalid-feedback">{{ $message }}</div>@enderror
                    </div>

                    <div class="mb-1">
                        <label class="form-label">Redirect URI</label>
                        <input name="ms_redirect_uri" class="form-control @error('ms_redirect_uri') is-invalid @enderror"
                               placeholder="https://worklance.example.com/login/microsoft/callback"
                               value="{{ old('ms_redirect_uri', $company->ms_redirect_uri) }}">
                        <small class="text-secondary">
                            Must match a URI registered on the app registration exactly, host and
                            spelling included. Either of these is handled here:
                            <code>{{ route('microsoft.callback.legacy') }}</code> (the shape
                            Obvizio uses) or <code>{{ route('admin.microsoft.callback') }}</code>.
                        </small>
                        @error('ms_redirect_uri')<div class="invalid-feedback">{{ $message }}</div>@enderror
                    </div>
                </div>
                <div class="card-footer d-flex align-items-center">
                    <span class="text-secondary">Saving clears the verified badge until the next ping.</span>
                    <button class="btn btn-primary ms-auto">Save settings</button>
                </div>
            </div>
        </form>
    </div>

    <div class="col-lg-5">
        <div class="card mb-3">
            <div class="card-header"><h3 class="card-title mb-0">Test the connection</h3></div>
            <div class="card-body">
                <p class="text-secondary">
                    Checks the client ID, secret and tenant against Entra and throws the
                    token away. Read-only: nothing is sent and no message is posted.
                </p>
                <p class="text-secondary">
                    It cannot check Graph access. Every call this integration makes is
                    delegated — made <em>as</em> the sending account — so those permissions
                    only exist once that account has signed in and consented.
                </p>
                <form method="POST" action="{{ route('admin.companies.microsoft.ping', $company) }}">
                    @csrf
                    <button class="btn btn-outline-primary w-100" @disabled(! $configured)>
                        <i class="ti ti-plug-connected me-1"></i> Ping Microsoft
                    </button>
                </form>
                @unless ($configured)
                    <small class="text-secondary d-block mt-2">
                        Client ID, tenant ID and secret must all be saved first.
                    </small>
                @endunless
            </div>
        </div>

        {{-- The sending account. Nothing can actually be sent until someone has
             signed in here, because every Graph call is made as them. --}}
        <div class="card mb-3">
            <div class="card-header d-flex align-items-center justify-content-between">
                <h3 class="card-title mb-0">Sending account</h3>
                @if ($connected)
                    <span class="badge bg-green-lt"><i class="ti ti-plug-connected me-1"></i>Connected</span>
                @else
                    <span class="badge bg-secondary-lt">Not connected</span>
                @endif
            </div>
            <div class="card-body">
                @if ($connected)
                    <div class="datagrid mb-3">
                        <div class="datagrid-item">
                            <div class="datagrid-title">Sending as</div>
                            <div class="datagrid-content">{{ $company->ms_bot_email ?: '—' }}</div>
                        </div>
                        <div class="datagrid-item">
                            <div class="datagrid-title">Connected</div>
                            <div class="datagrid-content">{{ $company->ms_bot_connected_at?->diffForHumans() ?: '—' }}</div>
                        </div>
                    </div>
                    <form method="POST" action="{{ route('admin.companies.microsoft.disconnect', $company) }}"
                          onsubmit="return confirm('Disconnect this account? Sending stops until it signs in again.')">
                        @csrf
                        <button class="btn btn-sm btn-outline-danger">Disconnect</button>
                    </form>
                @else
                    <p class="text-secondary">
                        Sign in as the account the messages should come from — not as yourself,
                        unless that is genuinely the sender. It grants the delegated scopes once
                        and Worklance keeps the connection alive from there.
                    </p>
                    <form method="POST" action="{{ route('admin.companies.microsoft.connect', $company) }}">
                        @csrf
                        <button class="btn btn-primary w-100" @disabled(! $configured || blank($company->ms_redirect_uri))>
                            <i class="ti ti-brand-windows me-1"></i> Connect sending account
                        </button>
                    </form>
                    @if ($configured && blank($company->ms_redirect_uri))
                        <small class="text-secondary d-block mt-2">Set the redirect URI above first.</small>
                    @endif
                @endif
            </div>
        </div>

        {{-- A real send, not a simulated one: consent, a recipient outside the
             tenant and a chat that will not open are all things that only fail
             on the real call. --}}
        <div class="card mb-3">
            <div class="card-header"><h3 class="card-title mb-0">Send test message</h3></div>
            <div class="card-body">
                <form method="POST" action="{{ route('admin.companies.microsoft.test', $company) }}">
                    @csrf
                    <div class="mb-2">
                        <label class="form-label">Send to</label>
                        <input name="test_email" type="email" required
                               class="form-control @error('test_email') is-invalid @enderror"
                               placeholder="someone@company.com"
                               value="{{ old('test_email') }}">
                        <small class="text-secondary">Any account in the same tenant.</small>
                        @error('test_email')<div class="invalid-feedback">{{ $message }}</div>@enderror
                    </div>
                    <div class="mb-2">
                        <label class="form-label">Message <span class="text-secondary">(optional)</span></label>
                        <textarea name="test_message" rows="2" maxlength="2000"
                                  class="form-control @error('test_message') is-invalid @enderror"
                                  placeholder="Leave blank for the default test message">{{ old('test_message') }}</textarea>
                        @error('test_message')<div class="invalid-feedback">{{ $message }}</div>@enderror
                    </div>
                    <button class="btn btn-outline-primary w-100" @disabled(! $connected)>
                        <i class="ti ti-send me-1"></i> Send test message
                    </button>
                </form>
                @unless ($connected)
                    <small class="text-secondary d-block mt-2">
                        Connect the sending account first — a message is posted as that person.
                    </small>
                @endunless
            </div>
        </div>

        <div class="card">
            <div class="card-header"><h3 class="card-title mb-0">What the tenant needs</h3></div>
            <div class="card-body text-secondary">
                <p>On the customer's app registration, under API permissions — all
                   <strong>delegated</strong>, none needing admin consent:</p>
                <ul class="mb-2">
                    <li><code>openid</code>, <code>profile</code>, <code>email</code> — sign the account in</li>
                    <li><code>offline_access</code> — keep it signed in without a person present</li>
                    <li><code>User.Read</code> — read the sending account's own profile</li>
                    <li><code>User.ReadBasic.All</code> — resolve a recipient by email address</li>
                    <li><code>Chat.Create</code>, <code>Chat.ReadWrite</code>,
                        <code>ChatMessage.Send</code> — open a 1:1 chat and post to it</li>
                </ul>
                <p>
                    No <strong>application</strong> permissions, and specifically not
                    <code>User.Read.All</code>. An app-only token cannot post to a 1:1 chat
                    as a person, which is the entire point of sending as the bot account.
                </p>
                <p>
                    <strong>A new registration needs admin consent once.</strong> These
                    permissions say "admin consent required: no", but most tenants let a
                    non-admin consent only to a short low-impact list, which
                    <code>Chat.*</code> and <code>User.ReadBasic.All</code> are not on. Until
                    someone presses <em>Grant admin consent</em> on the registration, signing
                    in shows "Need admin approval" rather than a consent prompt. A
                    registration that already had it granted never shows either.
                </p>
                <p class="mb-0">
                    Sign-in asks for exactly these nine and nothing else. A registration may
                    well list more — <code>ChatMessage.Read</code> often is — but asking for
                    one beyond what an admin already consented to reopens consent, and most
                    tenants only let a non-admin consent to a short list, so the extra scope
                    shows up as <em>Need admin approval</em> instead of signing in.
                </p>
            </div>
        </div>
</div>
@endsection