<?php

namespace App\Http\Controllers;

use App\DataTables\Admin\DirectCompanyDataTable;
use App\DynamicUser;
use App\Group;
use App\Mail\sendSuccessEmail;
use App\Mail\SubUserSendPasswordLink;
use App\User;
use App\Otp;
use App\RegistrationOtp;
use App\Services\OTPService;
use Carbon\Carbon;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\DB;
use Illuminate\Support\Facades\Hash;
use Illuminate\Support\Facades\Log;
use Illuminate\Support\Facades\Mail;
use App\Mail\SendSubUserDetailsMail;
use App\Mail\SendUpdateMail;
use App\Mail\SendDeleteMail;
use App\Mail\SendLockMail;
use Illuminate\Support\Facades\Validator;
use Illuminate\Support\Str;

class DynamicUserController extends Controller
{
    public function index(DirectCompanyDataTable  $dataTable)
    {
        return $dataTable->render('admin.company.direct');
    }

    public function create(Request $request,$otp_new)
    {

       if($request->isMethod('post'))
       {
            $request->validate([
                'username' => 'required|unique:dynamic_users',
                'email' => 'required|email|unique:dynamic_users',
                'phone_number' => 'required|unique:dynamic_users|digits_between:10,20',
                'group_id' => 'required',
            ]);

            // Log the request for debugging
            Log::info('Dynamic User Create - POST Request', [
                'user_id' => auth()->id(),
                'username' => auth()->user()->username,
                'request_data' => $request->all()
            ]);

            $inputs = $request->all();
            $password = uniqid();
            $inputs['password']      = ($password);
            $inputs['user_id']       = auth()->user()->id;

            DB::beginTransaction();
                DynamicUser::query()->create($inputs);
            DB::commit();

           $auth = auth()->user();

                        // Clear rate limit after successful action
            $otpService = new OTPService();
            $otpService->clearRateLimit($auth->phone_number);
            
            Log::info('Dynamic User Create - Rate limit cleared after successful action', [
                'phone_number' => $auth->phone_number,
                'action' => 'create'
            ]);
            
            if( $auth->role_id == 2) {
               $url  = route('login');
           }
           else if( $auth->role_id == 3){
               $url = route('reseller.login');
           }

           $email = $inputs['email'];
           $username = $inputs['username'];
           $created_by = $auth->created_by;
           $msg = "Your sub-account for Deywuro has been created with username and password
username : $username
password : $password
registered under $created_by
url : $url
Thank You,
Deywuro";

            $this->sendSms($msg,$inputs['phone_number']);
            $this->sendEmail($email,$username,$password,$created_by,$url);

            return redirect()->route('dynamic.users.index')->with('success', 'Sub-user account successfully created');

       }else{
           $check_user = auth()->user();
           
           // Log the GET request for debugging
           Log::info('Dynamic User Create - GET Request', [
               'user_id' => $check_user->id,
               'username' => $check_user->username,
               'phone_number' => $check_user->phone_number,
               'otp_parameter' => $otp_new
           ]);
           
           // If the OTP parameter is "verified", it means the OTP was already verified via AJAX
           if ($otp_new === 'verified') {
               Log::info('Dynamic User Create - OTP already verified via AJAX', [
                   'phone_number' => $check_user->phone_number
               ]);
           } else {
               // Use the same pattern as company registration - validate phone verification
               $otpService = new OTPService();
               $phoneValidation = $otpService->validatePhoneForRegistration($check_user->phone_number, 10);

               Log::info('Dynamic User Create - Phone Validation Result', [
                   'phone_number' => $check_user->phone_number,
                   'validation_result' => $phoneValidation
               ]);

               if (!$phoneValidation['valid']) {
                   Log::warning('Dynamic User Create - Phone not verified', [
                       'phone_number' => $check_user->phone_number,
                       'validation_message' => $phoneValidation['message']
                   ]);
                   
                   return redirect()->route('dynamic.users.index')->with("error", $phoneValidation['message'] ?? "Verify your account before creation.");
               }

               Log::info('Dynamic User Create - Phone verified successfully', [
                   'phone_number' => $check_user->phone_number,
                   'verified_at' => $phoneValidation['verified_at'] ?? 'N/A'
               ]);
           }

           return view('admin.company.direct_create',[
               'groups'=>Group::query()->get()
           ]);
       }

    }

    public function edit(Request $request, $id, $otp_new){

        if($request->isMethod('post'))
        {
            $request->validate([
                'username' => 'required|unique:dynamic_users,username,'.$id,
                'email' => 'required|email|unique:dynamic_users,email,'.$id,
                'phone_number' => 'required|digits_between:10,20|unique:dynamic_users,phone_number,'.$id,
                'group_id' => 'required',
            ]);


            $inputs = $request->all();
//            $password = uniqid();
//            $inputs['password']      = ($password);
            $inputs['user_id']       = auth()->user()->id;

            DB::beginTransaction();
            $subuser = DynamicUser::find($id);
            if ($subuser) {
                $subuser->update($inputs);
            }
            DB::commit();

            $auth = auth()->user();

            // Clear rate limit after successful action
            $otpService = new OTPService();
            $otpService->clearRateLimit($auth->phone_number);
            
            Log::info('Dynamic User Edit - Rate limit cleared after successful action', [
                'phone_number' => $auth->phone_number,
                'action' => 'edit',
                'edit_user_id' => $id
            ]);

            if( $auth->role_id == 2) {
                $url  = route('login');
            }
            else if( $auth->role_id == 3){
                $url = route('reseller.login');
            }


            $email = $inputs['email'];
            $username = $inputs['username'];
            $created_by = $auth->created_by;
            $msg = "Your sub-account for Deywuro has been updated by the Administrator.
Thank You,
Deywuro";

            $this->sendSms($msg,$inputs['phone_number']);
            $this->sendUpdateEmail($email,$username);

            return redirect()->route('dynamic.users.index')->with('success', 'Sub-user account successfully updated');

        }else{

            $check_user = auth()->user();
            
            // Log the GET request for debugging
            Log::info('Dynamic User Edit - GET Request', [
                'user_id' => $check_user->id,
                'username' => $check_user->username,
                'phone_number' => $check_user->phone_number,
                'otp_parameter' => $otp_new,
                'edit_user_id' => $id
            ]);
            
            // If the OTP parameter is "verified", it means the OTP was already verified via AJAX
            if ($otp_new === 'verified') {
                Log::info('Dynamic User Edit - OTP already verified via AJAX', [
                    'phone_number' => $check_user->phone_number,
                    'edit_user_id' => $id
                ]);
            } else {
                // Use the same pattern as company registration - validate phone verification
                $otpService = new OTPService();
                $phoneValidation = $otpService->validatePhoneForRegistration($check_user->phone_number, 10);

                Log::info('Dynamic User Edit - Phone Validation Result', [
                    'phone_number' => $check_user->phone_number,
                    'validation_result' => $phoneValidation
                ]);

                if (!$phoneValidation['valid']) {
                    Log::warning('Dynamic User Edit - Phone not verified', [
                        'phone_number' => $check_user->phone_number,
                        'validation_message' => $phoneValidation['message']
                    ]);
                    
                    return redirect()->route('dynamic.users.index')->with("error", $phoneValidation['message'] ?? "Verify your account before editing.");
                }

                Log::info('Dynamic User Edit - Phone verified successfully', [
                    'phone_number' => $check_user->phone_number,
                    'verified_at' => $phoneValidation['verified_at'] ?? 'N/A'
                ]);
            }


            $user = DynamicUser::find($id);
            $groups = Group::query()->get();
            $user_group = Group::find($user->group_id);
            return view('admin.company.direct_edit', compact('user', 'groups','user_group'));

        }
    }

    // Delete sub user
    public function destroy(Request $request, $id, $otp_new){

        $check_user = auth()->user();
        
        // Log the GET request for debugging
        Log::info('Dynamic User Delete - GET Request', [
            'user_id' => $check_user->id,
            'username' => $check_user->username,
            'phone_number' => $check_user->phone_number,
            'otp_parameter' => $otp_new,
            'delete_user_id' => $id
        ]);
        
        // If the OTP parameter is "verified", it means the OTP was already verified via AJAX
        if ($otp_new === 'verified') {
            Log::info('Dynamic User Delete - OTP already verified via AJAX', [
                'phone_number' => $check_user->phone_number,
                'delete_user_id' => $id
            ]);
        } else {
            // Use the same pattern as company registration - validate phone verification
            $otpService = new OTPService();
            $phoneValidation = $otpService->validatePhoneForRegistration($check_user->phone_number, 10);

            Log::info('Dynamic User Delete - Phone Validation Result', [
                'phone_number' => $check_user->phone_number,
                'validation_result' => $phoneValidation
            ]);

            if (!$phoneValidation['valid']) {
                Log::warning('Dynamic User Delete - Phone not verified', [
                    'phone_number' => $check_user->phone_number,
                    'validation_message' => $phoneValidation['message']
                ]);
                
                return redirect()->route('dynamic.users.index')->with("error", $phoneValidation['message'] ?? "Verify your account before deleting user.");
            }

            Log::info('Dynamic User Delete - Phone verified successfully', [
                'phone_number' => $check_user->phone_number,
                'verified_at' => $phoneValidation['verified_at'] ?? 'N/A'
            ]);
        }

        DB::beginTransaction();
        $subuser = DynamicUser::find($id);
        if ($subuser) {
            $subuser->delete();
        }
        DB::commit();

        // Clear rate limit after successful action
        $otpService = new OTPService();
        $otpService->clearRateLimit($check_user->phone_number);

        $email = $subuser->email;
        $username = $subuser->username;
        $phone_number = $subuser->phone_number;

        $msg = "Your sub-account for Deywuro has been deleted by the Administrator.
Thank You,
Deywuro";

        $this->sendSms($msg,$phone_number);
        $this->sendDeleteEmail($email,$username);

        return redirect()->route('dynamic.users.index')->with('success', 'Sub-user account successfully deleted');

    }

    // Lock sub user
    public function lock(Request $request, $id, $otp_new){

        $check_user = auth()->user();
        
        // Log the GET request for debugging
        Log::info('Dynamic User Lock - GET Request', [
            'user_id' => $check_user->id,
            'username' => $check_user->username,
            'phone_number' => $check_user->phone_number,
            'otp_parameter' => $otp_new,
            'lock_user_id' => $id
        ]);
        
        // If the OTP parameter is "verified", it means the OTP was already verified via AJAX
        if ($otp_new === 'verified') {
            Log::info('Dynamic User Lock - OTP already verified via AJAX', [
                'phone_number' => $check_user->phone_number,
                'lock_user_id' => $id
            ]);
        } else {
            // Use the same pattern as company registration - validate phone verification
            $otpService = new OTPService();
            $phoneValidation = $otpService->validatePhoneForRegistration($check_user->phone_number, 10);

            Log::info('Dynamic User Lock - Phone Validation Result', [
                'phone_number' => $check_user->phone_number,
                'validation_result' => $phoneValidation
            ]);

            if (!$phoneValidation['valid']) {
                Log::warning('Dynamic User Lock - Phone not verified', [
                    'phone_number' => $check_user->phone_number,
                    'validation_message' => $phoneValidation['message']
                ]);
                
                return redirect()->route('dynamic.users.index')->with("error", $phoneValidation['message'] ?? "Verify your account before locking user.");
            }

            Log::info('Dynamic User Lock - Phone verified successfully', [
                'phone_number' => $check_user->phone_number,
                'verified_at' => $phoneValidation['verified_at'] ?? 'N/A'
            ]);
        }

        DB::beginTransaction();
        $subuser = DynamicUser::find($id);
        if ($subuser) {
            if((boolean) $subuser->is_locked == true){
                $subuser->update([
                    'is_locked' => false
                ]);
                $msg = "Your sub-account for Deywuro has been un-locked by the Administrator.
Thank You,
Deywuro";
            }else{
                $subuser->update([
                    'is_locked' => true
                ]);
                $msg = "Your sub-account for Deywuro has been locked by the Administrator.
Thank You,
Deywuro";
            }

        }
        DB::commit();

        // Clear rate limit after successful action
        $otpService = new OTPService();
        $otpService->clearRateLimit($check_user->phone_number);
        
        Log::info('Dynamic User Lock - Rate limit cleared after successful action', [
            'phone_number' => $check_user->phone_number,
            'action' => 'lock',
            'lock_user_id' => $id
        ]);

        $email = $subuser->email;
        $username = $subuser->username;
        $phone_number = $subuser->phone_number;
        $is_locked =(boolean) $subuser->is_locked;

        $this->sendSms($msg,$phone_number);
        $this->sendLockEmail($email,$username,$is_locked);

        if ($is_locked){
            return redirect()->route('dynamic.users.index')->with('success', 'Sub-user account successfully locked');
        }else{
            return redirect()->route('dynamic.users.index')->with('success', 'Sub-user account successfully unlocked');
        }
    }

    // Send  Reset Password Link
    public function sendResetLink(Request $request, $id, $otp_new){

        $check_user = auth()->user();
        
        // Log the GET request for debugging
        Log::info('Dynamic User Send Reset Link - GET Request', [
            'user_id' => $check_user->id,
            'username' => $check_user->username,
            'phone_number' => $check_user->phone_number,
            'otp_parameter' => $otp_new,
            'reset_user_id' => $id
        ]);
        
        // If the OTP parameter is "verified", it means the OTP was already verified via AJAX
        if ($otp_new === 'verified') {
            Log::info('Dynamic User Send Reset Link - OTP already verified via AJAX', [
                'phone_number' => $check_user->phone_number,
                'reset_user_id' => $id
            ]);
        } else {
            // Use the same pattern as company registration - validate phone verification
            $otpService = new OTPService();
            $phoneValidation = $otpService->validatePhoneForRegistration($check_user->phone_number, 10);

            Log::info('Dynamic User Send Reset Link - Phone Validation Result', [
                'phone_number' => $check_user->phone_number,
                'validation_result' => $phoneValidation
            ]);

            if (!$phoneValidation['valid']) {
                Log::warning('Dynamic User Send Reset Link - Phone not verified', [
                    'phone_number' => $check_user->phone_number,
                    'validation_message' => $phoneValidation['message']
                ]);
                
                return redirect()->route('dynamic.users.index')->with("error", $phoneValidation['message'] ?? "Verify your account before sending password reset link.");
            }

            Log::info('Dynamic User Send Reset Link - Phone verified successfully', [
                'phone_number' => $check_user->phone_number,
                'verified_at' => $phoneValidation['verified_at'] ?? 'N/A'
            ]);
        }

        $subuser = DynamicUser::find($id);
        if ($subuser) {
            $token = Str::random(60);
            //Create Password Reset Token
            $subuser->update([
                'token' => $token
            ]);
        }

        // Clear rate limit after successful action
        $otpService = new OTPService();
        $otpService->clearRateLimit($check_user->phone_number);
        
        Log::info('Dynamic User Send Reset Link - Rate limit cleared after successful action', [
            'phone_number' => $check_user->phone_number,
            'action' => 'sendResetLink',
            'reset_user_id' => $id
        ]);

        $email = $subuser->email;
        $name = $subuser->username;
        $link = route('dynamic.users.getPasswordView',['token' => $token, 'email' => urlencode($subuser->email)]);

        if ($this->sendPasswordResetEmail($name,$email,$link)) {
            return redirect()->back()->with('success', "A reset link has been sent to {$subuser->email}.");
        }
        else {
            return redirect()->back()->with('error','Sending Password reset link failed');
        }
    }

    // Get getResetPasswordView
    public function getResetPasswordView(Request $request, $token){
        $email = urldecode($request->email);
        return view('admin.company.dynamic_update', compact('email','token'));
    }
    // Update Password
    public function updatePassword(Request $request){

            //Validate input
            $request->validate([
                'email' => 'required|email|exists:dynamic_users,email',
                'password' => 'required|confirmed'
            ]);
            $validator = Validator::make($request->all(), [
                'token' => 'required'
            ]);

            //check if payload is valid before moving on
            if ($validator->fails()) {
                return redirect()->back()->withErrors(['email' => 'Token is required']);
            }

            $password = $request->password;
            // Validate the token
            $tokenData = DynamicUser::query()->where('token','=',$request->token)->first();

            // Redirect the user back to the password reset request form if the token is invalid
            if (!$tokenData)
                return redirect()->back()->withErrors(['email' => 'Password reset failed, try again']);

            $dynamic_user = DynamicUser::query()->where('email', $tokenData->email)->first();

            // Redirect the user back if the email is invalid
            if (!$dynamic_user)
                return redirect()->back()->withInput()->withErrors(['email' => 'Email not found']);

            $dynamic_user->update([
               'password' => $password,
               'token' => null
            ]);

            //Send Email Reset Success Email
            return redirect()->route('login')->with('success','Successfully updated password');
//            if ($this->sendSuccessEmail($tokenData->email, $tokenData->username)) {
//                return redirect()->route('login')->with('success','Successfully updated password');
//            } else {
//                return redirect()->back()->withInput()->withErrors(['email' => 'Password update failed. Please try again.']);
//            }
    }

    // show sub user
    public function show($id){

        $user = DynamicUser::find($id);
        $user_group = Group::find($user->group_id);
        return view('admin.company.direct_show', compact('user', 'user_group'));
    }

    public function sendOTP($text,$source = 'Deywuro', $otp){
        $phone_number = auth()->user()->phone_number;

        Otp::query()->create([
            'userID' => auth()->id(),
            'username' => auth()->user()->username,
            'msisdn' => $phone_number,
            'code' => $otp,
            'status' => 'pending',
        ]);

        $message = urlencode($text);
        $num = urlencode($phone_number);

        $url = "https://deywuro.com/api/sms?username=sammy&password=cse%402021_npontu&source=$source&destination=" . $num . "&message=" . $message;

        $curl = curl_init($url);
        curl_setopt($curl, CURLOPT_SSL_VERIFYPEER, false);
        curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
        $output = curl_exec($curl);
        curl_close($curl);


        return response()->json(json_decode($output));
    }

    public function verifyOTP(Request $request){

        $request->validate(['otp' => 'required']);
        $number = auth()->user()->phone_number;
        $otp = Otp::query()->where('code', $request->otp)->where('msisdn',$number)->first();

        if($otp)
        {
            if(now()->greaterThan(Carbon::parse($otp->created_at)->addMinutes(5)))
            {
                if($otp->status == 'pending')
                {
                    $otp->update(['status' =>'expired']);

#                   facsimile => a copy or autotype
                }

                return response()->json(['message' => 'Token has expired', 'status' => 'error']);

            }else{

                if($otp->status == 'pending')
                {
                    $otp->update(['status' => 'verified', 'confirmation_date' => now()]);

                    return response()->json(['message' => 'verified', 'status' => 'success', 'type' => $request->type]);

                }else{

                    return response()->json(['message' => 'Token has been used', 'status' => 'error']);
                }

            }

        }else{

            return response()->json(['message' => 'Invalid Token', 'status' => 'error']);
        }

    }

    // ==================== SECURE OTP METHODS ====================

    /**
     * Generate session token for secure OTP operations
     */
    public function generateSession(Request $request)
    {
        $request->validate([
            'action' => 'required|string|in:create,edit,delete,lock,reset_password'
        ]);

        $user = auth()->user();
        $otpService = new OTPService();
        $sessionToken = $otpService->generateSessionToken();

        // Create session (action is not stored in database, just used for validation)
        $otpService->createRegistrationSession($sessionToken, [
            'phone_number' => $user->phone_number,
            'otp_code' => '',
            'user_id' => $user->id
        ]);

        return response()->json([
            'success' => true,
            'session_token' => $sessionToken,
            'message' => 'Session generated successfully'
        ]);
    }

    /**
     * Send secure OTP for dynamic user management
     */
    public function sendSecureOTP(Request $request)
    {
        $request->validate([
            'session_token' => 'required|string'
        ]);

        $user = auth()->user();

        try {
            $otpService = new OTPService();

            // Verify session token
            if (!$otpService->verifySessionToken($request->session_token)) {
                return response()->json([
                    'success' => false,
                    'message' => 'Invalid session token'
                ], 400);
            }

            // Process OTP request
            $result = $otpService->processOTPRequest(
                $user->phone_number,
                $request->session_token,
                'DEYWURO',
                "Hello, your dynamic user management OTP is {otp}. Valid for 5 minutes."
            );

            if ($result['code'] === 0) {
                return response()->json([
                    'success' => true,
                    'message' => 'OTP sent successfully',
                    'session_token' => $request->session_token
                ]);
            } else {
                return response()->json([
                    'success' => false,
                    'message' => $result['msg']
                ], 400);
            }
        } catch (\Exception $e) {
            return response()->json([
                'success' => false,
                'message' => 'Failed to send OTP. Please try again.'
            ], 500);
        }
    }

    /**
     * Verify secure OTP for dynamic user management
     */
    public function verifySecureOTP(Request $request)
    {
        $request->validate([
            'session_token' => 'required|string',
            'otp' => 'required|string|size:6'
        ]);

        $user = auth()->user();

        try {
            $otpService = new OTPService();

            // Verify session token
            if (!$otpService->verifySessionToken($request->session_token)) {
                return response()->json([
                    'success' => false,
                    'message' => 'Invalid session token'
                ], 400);
            }

            // Complete OTP verification
            $result = $otpService->completeOTPVerification(
                $user->phone_number,
                $request->session_token,
                $request->otp
            );

            if ($result['code'] === 0) {
                return response()->json([
                    'success' => true,
                    'message' => 'OTP verified successfully',
                    'action' => $request->action,
                    'session_token' => $request->session_token
                ]);
            } else {
                return response()->json([
                    'success' => false,
                    'message' => $result['msg']
                ], 400);
            }
        } catch (\Exception $e) {
            return response()->json([
                'success' => false,
                'message' => 'Failed to verify OTP. Please try again.'
            ], 500);
        }
    }

    /**
     * Cleanup session token
     */
    public function cleanupSession(Request $request)
    {
        $request->validate([
            'session_token' => 'required|string'
        ]);

        $otpService = new OTPService();
        $otpService->cleanupSession($request->session_token);

        return response()->json([
            'success' => true,
            'message' => 'Session cleaned up successfully'
        ]);
    }

    // ==================== SECURE ACTION METHODS ====================

    /**
     * Create dynamic user with secure OTP verification
     */
    public function createSecure(Request $request)
    {
        $request->validate([
            'session_token' => 'required|string',
            'username' => 'required|unique:dynamic_users',
            'email' => 'required|email|unique:dynamic_users',
            'phone_number' => 'required|unique:dynamic_users|digits_between:10,20',
            'group_id' => 'required',
        ]);

        $user = auth()->user();

        // Verify session and OTP
        $otpService = new OTPService();
        if (!$otpService->verifySessionToken($request->session_token)) {
            return response()->json([
                'success' => false,
                'message' => 'Invalid or expired session. Please request a new OTP.'
            ], 400);
        }

        $sessionData = $otpService->getSessionData($request->session_token);
        if (!$sessionData || !$sessionData['otp_verified'] || $sessionData['action'] !== 'create') {
            return response()->json([
                'success' => false,
                'message' => 'Invalid session or OTP not verified. Please request a new OTP.'
            ], 400);
        }

        try {
            DB::beginTransaction();

            $inputs = $request->all();
            $password = uniqid();
            $inputs['password'] = $password;
            $inputs['user_id'] = $user->id;

            DynamicUser::query()->create($inputs);

            DB::commit();

            // Send notifications
            $this->sendUserCreationNotifications($inputs, $password, $user);

            // Cleanup session
            $otpService->cleanupSession($request->session_token);

            return response()->json([
                'success' => true,
                'message' => 'Sub-user account successfully created'
            ]);

        } catch (\Exception $e) {
            DB::rollback();
            return response()->json([
                'success' => false,
                'message' => 'Failed to create user. Please try again.'
            ], 500);
        }
    }

    /**
     * Edit dynamic user with secure OTP verification
     */
    public function editSecure(Request $request, $id)
    {
        $request->validate([
            'session_token' => 'required|string',
            'username' => 'required|unique:dynamic_users,username,'.$id,
            'email' => 'required|email|unique:dynamic_users,email,'.$id,
            'phone_number' => 'required|digits_between:10,20|unique:dynamic_users,phone_number,'.$id,
            'group_id' => 'required',
        ]);

        $user = auth()->user();

        // Verify session and OTP
        $otpService = new OTPService();
        if (!$otpService->verifySessionToken($request->session_token)) {
            return response()->json([
                'success' => false,
                'message' => 'Invalid or expired session. Please request a new OTP.'
            ], 400);
        }

        $sessionData = $otpService->getSessionData($request->session_token);
        if (!$sessionData || !$sessionData['otp_verified'] || $sessionData['action'] !== 'edit') {
            return response()->json([
                'success' => false,
                'message' => 'Invalid session or OTP not verified. Please request a new OTP.'
            ], 400);
        }

        try {
            DB::beginTransaction();

            $inputs = $request->all();
            $inputs['user_id'] = $user->id;

            $subuser = DynamicUser::find($id);
            if ($subuser) {
                $subuser->update($inputs);
            }

            DB::commit();

            // Send notifications
            $this->sendUserUpdateNotifications($inputs, $user);

            // Cleanup session
            $otpService->cleanupSession($request->session_token);

            return response()->json([
                'success' => true,
                'message' => 'Sub-user account successfully updated'
            ]);

        } catch (\Exception $e) {
            DB::rollback();
            return response()->json([
                'success' => false,
                'message' => 'Failed to update user. Please try again.'
            ], 500);
        }
    }

    /**
     * Delete dynamic user with secure OTP verification
     */
    public function destroySecure(Request $request, $id)
    {
        $request->validate([
            'session_token' => 'required|string',
        ]);

        $user = auth()->user();

        // Verify session and OTP
        $otpService = new OTPService();
        if (!$otpService->verifySessionToken($request->session_token)) {
            return response()->json([
                'success' => false,
                'message' => 'Invalid or expired session. Please request a new OTP.'
            ], 400);
        }

        $sessionData = $otpService->getSessionData($request->session_token);
        if (!$sessionData || !$sessionData['otp_verified'] || $sessionData['action'] !== 'delete') {
            return response()->json([
                'success' => false,
                'message' => 'Invalid session or OTP not verified. Please request a new OTP.'
            ], 400);
        }

        try {
            DB::beginTransaction();

            $subuser = DynamicUser::find($id);
            if ($subuser) {
                $subuser->delete();
            }

            DB::commit();

            // Send notifications
            $this->sendUserDeletionNotifications($subuser);

            // Cleanup session
            $otpService->cleanupSession($request->session_token);

            return response()->json([
                'success' => true,
                'message' => 'Sub-user account successfully deleted'
            ]);

        } catch (\Exception $e) {
            DB::rollback();
            return response()->json([
                'success' => false,
                'message' => 'Failed to delete user. Please try again.'
            ], 500);
        }
    }

    /**
     * Lock/Unlock dynamic user with secure OTP verification
     */
    public function lockSecure(Request $request, $id)
    {
        $request->validate([
            'session_token' => 'required|string',
        ]);

        $user = auth()->user();

        // Verify session and OTP
        $otpService = new OTPService();
        if (!$otpService->verifySessionToken($request->session_token)) {
            return response()->json([
                'success' => false,
                'message' => 'Invalid or expired session. Please request a new OTP.'
            ], 400);
        }

        $sessionData = $otpService->getSessionData($request->session_token);
        if (!$sessionData || !$sessionData['otp_verified'] || $sessionData['action'] !== 'lock') {
            return response()->json([
                'success' => false,
                'message' => 'Invalid session or OTP not verified. Please request a new OTP.'
            ], 400);
        }

        try {
            DB::beginTransaction();

            $subuser = DynamicUser::find($id);
            if ($subuser) {
                $isLocked = (boolean) $subuser->is_locked;
                $subuser->update([
                    'is_locked' => !$isLocked
                ]);
            }

            DB::commit();

            // Send notifications
            $this->sendUserLockNotifications($subuser, !$isLocked);

            // Cleanup session
            $otpService->cleanupSession($request->session_token);

            $action = !$isLocked ? 'locked' : 'unlocked';
            return response()->json([
                'success' => true,
                'message' => "Sub-user account successfully {$action}"
            ]);

        } catch (\Exception $e) {
            DB::rollback();
            return response()->json([
                'success' => false,
                'message' => 'Failed to update user status. Please try again.'
            ], 500);
        }
    }

    /**
     * Send password reset link with secure OTP verification
     */
    public function sendResetLinkSecure(Request $request, $id)
    {
        $request->validate([
            'session_token' => 'required|string',
        ]);

        $user = auth()->user();

        // Verify session and OTP
        $otpService = new OTPService();
        if (!$otpService->verifySessionToken($request->session_token)) {
            return response()->json([
                'success' => false,
                'message' => 'Invalid or expired session. Please request a new OTP.'
            ], 400);
        }

        $sessionData = $otpService->getSessionData($request->session_token);
        if (!$sessionData || !$sessionData['otp_verified'] || $sessionData['action'] !== 'reset_password') {
            return response()->json([
                'success' => false,
                'message' => 'Invalid session or OTP not verified. Please request a new OTP.'
            ], 400);
        }

        try {
            $subuser = DynamicUser::find($id);
            if ($subuser) {
                $token = Str::random(60);
                $subuser->update(['token' => $token]);

                $link = route('dynamic.users.getPasswordView', [
                    'token' => $token,
                    'email' => urlencode($subuser->email)
                ]);

                if ($this->sendPasswordResetEmail($subuser->username, $subuser->email, $link)) {
                    // Cleanup session
                    $otpService->cleanupSession($request->session_token);

                    return response()->json([
                        'success' => true,
                        'message' => "A reset link has been sent to {$subuser->email}."
                    ]);
                } else {
                    return response()->json([
                        'success' => false,
                        'message' => 'Sending Password reset link failed'
                    ], 500);
                }
            } else {
                return response()->json([
                    'success' => false,
                    'message' => 'User not found'
                ], 404);
            }

        } catch (\Exception $e) {
            return response()->json([
                'success' => false,
                'message' => 'Failed to send reset link. Please try again.'
            ], 500);
        }
    }

    // ==================== HELPER METHODS ====================

    /**
     * Send user creation notifications
     */
    private function sendUserCreationNotifications($inputs, $password, $auth)
    {
        $url = $this->getLoginUrl($auth);
        $created_by = $auth->created_by;

        $msg = "Your sub-account for Deywuro has been created with username and password
username : {$inputs['username']}
password : {$password}
registered under {$created_by}
url : {$url}
Thank You,
Deywuro";

        $this->sendSms($msg, $inputs['phone_number']);
        $this->sendEmail($inputs['email'], $inputs['username'], $password, $created_by, $url);
    }

    /**
     * Send user update notifications
     */
    private function sendUserUpdateNotifications($inputs, $auth)
    {
        $msg = "Your sub-account for Deywuro has been updated by the Administrator.
Thank You,
Deywuro";

        $this->sendSms($msg, $inputs['phone_number']);
        $this->sendUpdateEmail($inputs['email'], $inputs['username']);
    }

    /**
     * Send user deletion notifications
     */
    private function sendUserDeletionNotifications($subuser)
    {
        $msg = "Your sub-account for Deywuro has been deleted by the Administrator.
Thank You,
Deywuro";

        $this->sendSms($msg, $subuser->phone_number);
        $this->sendDeleteEmail($subuser->email, $subuser->username);
    }

    /**
     * Send user lock notifications
     */
    private function sendUserLockNotifications($subuser, $isLocked)
    {
        $msg = $isLocked
            ? "Your sub-account for Deywuro has been locked by the Administrator.\nThank You,\nDeywuro"
            : "Your sub-account for Deywuro has been un-locked by the Administrator.\nThank You,\nDeywuro";

        $this->sendSms($msg, $subuser->phone_number);
        $this->sendLockEmail($subuser->email, $subuser->username, $isLocked);
    }

    /**
     * Get login URL based on user role
     */
    private function getLoginUrl($auth)
    {
        if ($auth->role_id == 2) {
            return route('login');
        } elseif ($auth->role_id == 3) {
            return route('reseller.login');
        }
        return route('login');
    }

    private function sendEmail($email,$username,$password,$created_by,$url)
    {
        try{
            Mail::to($email)->send(new SendSubUserDetailsMail($username,$password,$created_by,$url));
        }catch (\Exception $ex){
        }
    }

    private function sendUpdateEmail($email,$username)
    {
        try{
            Mail::to($email)->send(new SendUpdateMail($username));
        }catch (\Exception $ex){
        }
    }

    private function sendDeleteEmail($email,$username)
    {
        try{
            Mail::to($email)->send(new SendDeleteMail($username));
        }catch (\Exception $ex){
        }
    }

    private function sendLockEmail($email,$username,$is_locked)
    {
        try{
            Mail::to($email)->send(new SendLockMail($username,$is_locked));
        }catch (\Exception $ex){
        }
    }

    private function sendPasswordResetEmail($name,$email,$link)
    {
        try{
            Mail::to($email)->send(new SubUserSendPasswordLink($name,$email,$link));
            return true;
        }catch (\Exception $ex){
            return false;
        }
    }

    private function sendSuccessEmail($mail, $username){
        try{
            Mail::to($mail)->send(new sendSuccessEmail($mail,$username));
            return true;
        }catch (\Exception $ex){
            return false;
        }
    }


}