<?php

namespace App\Model\Security;

use Nette\Security\IAuthenticator;
use Nette\Security\SimpleIdentity;
use Nette\Security\AuthenticationException;
use Nette\Security\Passwords;
use Nette\Database\Connection;

class Authenticator implements IAuthenticator
{
    private Connection $masterDb;
    private Passwords $passwords;

    public function __construct(Connection $masterDb, Passwords $passwords)
    {
        $this->masterDb = $masterDb;
        $this->passwords = $passwords;
    }

    public function authenticate(string $user, string $password): SimpleIdentity
    {
        // 1. Dotaz do centrální Master DB
        $row = $this->masterDb->fetch(
            'SELECT ID, EMAIL, HESLO_HASH, JMENO, PRIJMENI, DATABASE_HOST, DATABASE_NAME, DEFAULT_FIRMA_ID 
             FROM dbo.UZIVATEL 
             WHERE EMAIL = ? AND AKTIVNI = 1',
            $user
        );

        if (!$row || !$this->passwords->verify($password, $row->HESLO_HASH)) {
            throw new AuthenticationException('Nespravný e-mail nebo heslo.');
        }

        // 2. Všechny potřebné parametry pro KufrikConnectionFactory zabalíme do Nette Identity
        return new SimpleIdentity(
            $row->ID,
            null, // role (volitelně)
            [
                'email' => $row->EMAIL,
                'jmeno' => $row->JMENO . ' ' . $row->PRIJMENI,
                // Kufrik parametry:
                'db_host' => $row->DATABASE_HOST ?? '127.0.0.1', // Umožňuje i RŮZNÉ SERVERY!
                'db_name' => $row->DATABASE_NAME ?? 'Fakturace_MainDB',
                'firma_id' => $row->DEFAULT_FIRMA_ID,
            ]
        );
    }
}