<?php

declare(strict_types=1);
final class DevicesController
{
    public static function index(): void
    {
        render('account_devices.php', [
            'title' => t('devices.title'),
            'devices' => TrustedDeviceService::devices(),
            'currentSelector' => TrustedDeviceService::currentSelector(),
            'saved' => isset($_GET['saved']),
        ]);
    }
    public static function revoke(): void
    {
        self::postOnly();
        $id = (int) ($_POST['id'] ?? 0);
        TrustedDeviceService::revoke($id, (int) Auth::id());
        AuditService::log(
            'trusted_device_revoked',
            '/account/devices/revoke',
            'Appareil de confiance révoqué',
            'trusted_device',
            $id,
        );
        header('Location: /account/devices?saved=1');
        exit();
    }
    public static function revokeAll(): void
    {
        self::postOnly();
        DB::pdo()
            ->prepare("UPDATE trusted_devices SET revoked_at=datetime('now') WHERE user_id=? AND revoked_at IS NULL")
            ->execute([Auth::id()]);
        AuditService::log(
            'trusted_devices_revoked',
            '/account/devices/revoke-all',
            'Tous les appareils de confiance ont été révoqués',
        );
        Auth::logout();
        header('Location: /login');
        exit();
    }
    private static function postOnly(): void
    {
        if (($_SERVER['REQUEST_METHOD'] ?? 'GET') !== 'POST') {
            http_response_code(405);
            header('Allow: POST');
            exit();
        }
        if (!Auth::validCsrf($_POST['csrf'] ?? null)) {
            http_response_code(419);
            echo h(t('auth.session_expired'));
            exit();
        }
    }
}