<?php

namespace App\Notifications;

use Illuminate\Bus\Queueable;
use Illuminate\Notifications\Messages\MailMessage;
use Illuminate\Notifications\Notification;

/**
 * Fires to every super admin when the same email or IP has produced several
 * failed login attempts in a short window. Lets ops decide whether to lock
 * the account, change the password, or just raise the global throttle.
 */
class BruteForceLoginAlert extends Notification
{
    use Queueable;

    public function __construct(
        public readonly string $email,
        public readonly string $ip,
        public readonly int $failures,
        public readonly int $windowMinutes,
    ) {}

    public function via(object $notifiable): array
    {
        return ['database', 'mail'];
    }

    public function toArray(object $notifiable): array
    {
        return [
            'kind'           => 'brute_force_login_alert',
            'email'          => $this->email,
            'ip'             => $this->ip,
            'failures'       => $this->failures,
            'window_minutes' => $this->windowMinutes,
        ];
    }

    public function toMail(object $notifiable): MailMessage
    {
        return (new MailMessage)
            ->subject('TAKEONE — suspicious login attempts')
            ->greeting('Possible brute-force login attempt')
            ->line("The address {$this->email} has had {$this->failures} failed login attempts in the last {$this->windowMinutes} minutes.")
            ->line("Most recent attempt came from {$this->ip}.")
            ->line('Review the audit log and consider forcing a password reset if this account looks real.')
            ->action('Open Admin', url('/admin/audit-logs'));
    }
}