<?php

declare(strict_types=1);

require_once dirname(__DIR__) . '/src/App/bootstrap.php';

use App\App;
use App\AccountGate;
use App\AuthStatusRedirect;
use App\ConfigLoader;
use App\KeycloakAuth;

session_start();

$projectRoot = dirname(__DIR__);
$keycloakConfig = ConfigLoader::load($projectRoot, 'keycloak');
$registrationConfig = ConfigLoader::load($projectRoot, 'registration');
$auth = new KeycloakAuth($keycloakConfig);
$accountGate = new AccountGate($registrationConfig);

if (!$auth->isAuthenticated()) {
    $statusRedirect = AuthStatusRedirect::consume();

    if ($statusRedirect !== null) {
        header('Location: ' . $statusRedirect, true, 302);
        exit;
    }
}

if ($auth->isAuthenticated()) {
    $currentUser = is_array($_SESSION['desktop_auth']['user'] ?? null) ? $_SESSION['desktop_auth']['user'] : [];
    $accountCheck = $accountGate->checkUsername((string) ($currentUser['username'] ?? ''));

    if (!($accountCheck['allowed'] ?? false)) {
        $auth->logout();
        $target = (string) ($accountCheck['state'] ?? '') === 'pending'
            ? '/auth/pending/?username=' . urlencode((string) ($currentUser['username'] ?? ''))
            : '/auth/inactive/?message=' . urlencode((string) ($accountCheck['message'] ?? 'Dieses Konto ist noch nicht freigeschaltet.'));
        header('Location: ' . $target, true, 302);
        exit;
    }
}

$app = new App($projectRoot);
$desktopPayload = $app->desktopPayload();

require $projectRoot . '/partials/desktop/shell.php';