<?php

use MintyPHP\Router;
use MintyPHP\Service\Access\PermissionService;
use MintyPHP\Service\User\UserAccessPdfService;
use MintyPHP\Service\User\UserServicesFactory;
use MintyPHP\Support\Flash;
use MintyPHP\Support\Guard;

define('MINTY_ALLOW_OUTPUT', true);

// Hard gate: user must be logged in and explicitly allowed to generate access PDFs.
Guard::requireLogin();
Guard::requirePermissionOrForbidden(PermissionService::USERS_ACCESS_PDF);
$userAccountService = (new UserServicesFactory())->createUserAccountService();

if (strtoupper((string) ($_SERVER['REQUEST_METHOD'] ?? 'GET')) !== 'POST') {
    Router::redirect('admin/users');
    return;
}

$raw = $_POST['uuids'] ?? '';
$uuids = [];
if (is_array($raw)) {
    $uuids = $raw;
} elseif (is_string($raw)) {
    $uuids = explode(',', $raw);
}
$uuids = array_values(array_unique(array_filter(array_map('trim', $uuids))));
if (!$uuids) {
    Flash::error(t('No valid users selected'), 'admin/users', 'users_access_pdf_no_selection');
    Router::redirect('admin/users');
    return;
}

if (count($uuids) > 100) {
    // Server-side hard limit to keep synchronous ZIP generation predictable.
    Flash::error(t('Too many users selected'), 'admin/users', 'users_access_pdf_too_many');
    Router::redirect('admin/users');
    return;
}

$currentUserId = (int) ($_SESSION['user']['id'] ?? 0);
$users = [];
foreach ($uuids as $uuid) {
    $user = $userAccountService->findByUuid($uuid);
    if (!$user) {
        continue;
    }
    $userId = (int) ($user['id'] ?? 0);
    if ($userId <= 0) {
        continue;
    }
    // Scope check per user prevents cross-tenant exports in mixed selections.
    if (!directoryServicesFactory()->createDirectoryScopeGateway()->canAccess('users', $userId, $currentUserId)) {
        continue;
    }
    $users[] = $user;
}

if (!$users) {
    Flash::error(t('No valid users selected'), 'admin/users', 'users_access_pdf_not_allowed');
    Router::redirect('admin/users');
    return;
}

if (!class_exists(ZipArchive::class)) {
    // Explicit runtime dependency check for environments missing ext-zip.
    Flash::error(t('ZIP support missing (ext-zip)'), 'admin/users', 'users_access_pdf_zip_missing');
    Router::redirect('admin/users');
    return;
}

$zip = UserAccessPdfService::renderUsersAccessZip($users);
$zipPath = (string) ($zip['path'] ?? '');
$zipFilename = trim((string) ($zip['filename'] ?? ''));
$zipCount = (int) ($zip['count'] ?? 0);

if ($zipPath === '' || !is_file($zipPath) || $zipCount <= 0) {
    Flash::error(t('Failed to generate access PDF'), 'admin/users', 'users_access_pdf_failed');
    Router::redirect('admin/users');
    return;
}

if ($zipFilename === '') {
    $zipFilename = 'user-invitations-' . gmdate('Ymd-His') . '.zip';
}

try {
    header('Content-Type: application/zip');
    header('Content-Disposition: attachment; filename="' . $zipFilename . '"');
    header('Cache-Control: private, no-store, max-age=0');
    header('Pragma: no-cache');
    header('X-Content-Type-Options: nosniff');
    header('Content-Length: ' . filesize($zipPath));
    readfile($zipPath);
} finally {
    // Always delete temporary archive, including partial-failure paths.
    @unlink($zipPath);
}