<?php

namespace App\Rules;

use Closure;
use Illuminate\Contracts\Validation\ValidationRule;

/**
 * Blocks impersonation of staff/system accounts.
 *
 * Applied to both `name` and the email local-part at registration so a user
 * cannot sign up as "admin", "superadmin", "takeone", etc. — words that would
 * let them pass themselves off as the platform or its operators to other
 * users (comments, DMs, channel pages).
 */
class ReservedIdentifier implements ValidationRule
{
    private const RESERVED = [
        'admin', 'administrator', 'superadmin', 'super-admin', 'super_admin',
        'root', 'sysadmin', 'system', 'owner', 'webmaster', 'postmaster',
        'moderator', 'mod', 'staff', 'official',
        'support', 'help', 'helpdesk', 'contact', 'info', 'noreply', 'no-reply',
        'security', 'abuse', 'billing',
        'takeone', 'take-one', 'take_one', 'takeonebh', 'takeone-bh',
        'play', 'playbh', 'playtakeone',
        'anonymous', 'guest', 'null', 'undefined',
    ];

    public function __construct(private readonly string $kind = 'name')
    {
    }

    public function validate(string $attribute, mixed $value, Closure $fail): void
    {
        if (! is_string($value)) {
            return;
        }

        $candidate = $this->kind === 'email'
            ? strtolower(trim(strstr($value, '@', true) ?: $value))
            : strtolower(trim($value));

        // Collapse separators so "super_admin", "super-admin" and "superadmin" all match.
        $normalized = preg_replace('/[\s._\-]+/', '', $candidate) ?? $candidate;

        foreach (self::RESERVED as $word) {
            $target = preg_replace('/[\s._\-]+/', '', $word) ?? $word;
            if ($normalized === $target) {
                $fail($this->kind === 'email'
                    ? 'That email address is reserved. Please use a different one.'
                    : 'That name is reserved. Please choose a different one.');
                return;
            }
        }
    }
}