<?php

namespace App\Http\Controllers\Auth;

use App\Http\Controllers\Controller;
use App\Models\User;
use App\Notifications\NewUserRegistered;
use App\Rules\NotDisposableEmail;
use App\Rules\ReservedIdentifier;
use App\Support\SafeNotifier;
use Illuminate\Auth\Events\Registered;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Hash;
use Illuminate\Validation\Rules\Password;

class RegisteredUserController extends Controller
{
    public function create()
    {
        return view('auth.register');
    }

    public function store(Request $request)
    {
        // Honeypot — bots fill hidden fields; real users never do
        if ($request->filled('_hp')) {
            // Silently appear to succeed to confuse the bot
            return redirect()->route('login');
        }

        $request->validate([
            'name'        => ['required', 'string', 'max:255', new ReservedIdentifier('name')],
            'email'       => ['required', 'string', 'email', 'max:255', 'unique:users', new NotDisposableEmail, new ReservedIdentifier('email')],
            'password'    => ['required', 'confirmed', Password::defaults()],
            // Age gate: must be at least 13 on sign-up day. The front-end
            // date picker already caps the year dropdown, but the server
            // must enforce it so a client bypass doesn't let a 10-year-old
            // through.
            'birthday'    => ['required', 'date', 'before:' . now()->subYears(13)->toDateString()],
            'gender'      => ['required', 'in:male,female'],
            'nationality' => ['required', 'string', 'size:2'],
        ]);

        $user = User::create([
            'name'        => $request->name,
            'email'       => $request->email,
            'password'    => Hash::make($request->password),
            'birthday'    => $request->birthday,
            'gender'      => $request->gender,
            'nationality' => $request->nationality,
        ]);

        event(new Registered($user));

        // Notify all super admins of the new registration
        User::where('role', 'super_admin')->each(function (User $admin) use ($user) {
            SafeNotifier::send($admin, new NewUserRegistered($user));
        });

        auth()->login($user);

        return redirect()->route('verification.notice');
    }
}