<?php

namespace Database\Seeders;

use App\Models\OAuthClient;
use App\Models\Tenant;
use Illuminate\Database\Seeder;
use Illuminate\Support\Arr;
use Illuminate\Support\Str;

class OAuthClientSeeder extends Seeder
{
    /**
     * Run the database seeds.
     */
    public function run(): void
    {
        $serviceConfig = config('services.oauth.tenant_admin', []);

        $clientId = $serviceConfig['id'] ?? 'tenant-admin-app';
        $tenantId = Tenant::where('slug', 'demo')->value('id')
            ?? Tenant::query()->orderBy('id')->value('id');

        $redirectUris = Arr::wrap($serviceConfig['redirects'] ?? []);
        if (empty($redirectUris)) {
            $redirectUris = [
                'http://localhost:5173/event-admin/auth/callback',
                'http://localhost:8000/event-admin/auth/callback',
            ];
        }

        $scopes = [
            'tenant:read',
            'tenant:write',
        ];

        $client = OAuthClient::firstOrNew(['client_id' => $clientId]);

        if (!$client->exists) {
            $client->id = (string) Str::uuid();
        }

        $client->fill([
            'client_secret' => null, // Public client, no secret needed for PKCE
            'tenant_id' => $tenantId,
            'redirect_uris' => $redirectUris,
            'scopes' => $scopes,
            'is_active' => true,
        ]);

        $client->save();
    }
}