<?php

declare(strict_types=1);

namespace Maestro\Core\Services;

use Illuminate\Contracts\Auth\Authenticatable;
use Illuminate\Database\Eloquent\Model;
use Maestro\Core\Support\AuthUserResolver;

/**
 * Resolves users for Microsoft Entra SSO.
 *
 * Users must be pre-provisioned with {@see $user->microsoft_user_id} set to their Azure object id (oid).
 * Just-in-time account creation is intentionally not implemented — same policy as Top Level Punt.
 */
final class MicrosoftAuthService
{
    public static function isConfigured(): bool
    {
        $id = config('services.microsoft.client_id');
        $secret = config('services.microsoft.client_secret');
        $redirect = config('services.microsoft.redirect');

        return is_string($id) && $id !== ''
            && is_string($secret) && $secret !== ''
            && is_string($redirect) && $redirect !== '';
    }

    /**
     * @return (Model&Authenticatable)|null
     */
    public function findUserByMicrosoftId(string $microsoftUserId): ?Model
    {
        $class = AuthUserResolver::eloquentModelClass();

        return $class::query()
            ->where('microsoft_user_id', $microsoftUserId)
            ->where('is_active', true)
            ->first();
    }
}
