<?php

namespace App\Console\Commands;

use App\Models\Tenant;
use App\Services\Graph\DirectorySync;
use Illuminate\Console\Command;
use Illuminate\Support\Facades\Cache;
use Throwable;

class SyncDirectory extends Command
{
    protected $signature = 'signature:sync {--full : Synchro complète (ignore le deltaLink)} {--tenant= : ID local du tenant}';

    protected $description = 'Réplique utilisateurs et groupes signature_* depuis Microsoft Graph';

    public function handle(DirectorySync $sync): int
    {
        $tenants = Tenant::where('active', true)
            ->when($this->option('tenant'), fn ($q, $id) => $q->whereKey($id))
            ->get();

        $failed = false;
        foreach ($tenants as $tenant) {
            // Même verrou que le bouton du back-office.
            $lock = Cache::lock("signature-sync:{$tenant->id}", 600);
            if (! $lock->get()) {
                $this->warn("{$tenant->name} : synchronisation déjà en cours, ignorée.");
                continue;
            }
            try {
                $s = $sync->run($tenant, (bool) $this->option('full'));
                $this->info(sprintf('%s : %d utilisateurs mis à jour, %d retirés, %d groupes, %d appartenances',
                    $tenant->name, $s['users'], $s['removed'], $s['groups'], $s['memberships']));
            } catch (Throwable $e) {
                $failed = true;
                $this->error("{$tenant->name} : {$e->getMessage()}");
            } finally {
                $lock->release();
            }
        }

        return $failed ? self::FAILURE : self::SUCCESS;
    }
}