defmodule MicrowavepropWeb.ApiTokenController do
  @moduledoc """
  User-facing CRUD for long-lived `/api/v1` bearer tokens. The plaintext
  token is surfaced exactly once via flash on creation; only the SHA-256
  hash is persisted, so revocation is the only path back if the user
  loses it.
  """

  use MicrowavepropWeb, :controller

  alias Microwaveprop.Accounts

  def create(conn, %{"api_token" => params}) do
    user = conn.assigns.current_scope.user

    case Accounts.create_api_token(user, params) do
      {:ok, {plaintext, record}} ->
        conn
        |> put_flash(:info, "API token '#{record.name}' created. Copy it now — it is shown once.")
        |> put_flash(:api_token, plaintext)
        |> redirect(to: ~p"/users/settings")

      {:error, changeset} ->
        message =
          changeset
          |> Ecto.Changeset.traverse_errors(fn {msg, _} -> msg end)
          |> Enum.map_join("; ", fn {k, v} -> "#{k}: #{Enum.join(v, ", ")}" end)

        conn
        |> put_flash(:error, "Could not create API token (#{message}).")
        |> redirect(to: ~p"/users/settings")
    end
  end

  def delete(conn, %{"id" => id}) do
    user = conn.assigns.current_scope.user

    conn =
      case Accounts.revoke_api_token(user, id) do
        {:ok, _token} -> put_flash(conn, :info, "API token revoked.")
        {:error, :not_found} -> put_flash(conn, :error, "API token not found.")
      end

    redirect(conn, to: ~p"/users/settings")
  end
end