<?php

namespace Database\Seeders;

use Illuminate\Database\Seeder;
use App\Models\AccessCatalog;
use App\Models\Department;
use App\Models\User;

class AccessCatalogSeeder extends Seeder
{
    public function run(): void
    {
        $departments = Department::all();
        $itDept = $departments->where('code', 'IT')->first();
        $hrDept = $departments->where('code', 'HR')->first();
        $adminDept = $departments->where('code', 'ADM')->first();
        $superAdmin = User::where('role', 'super_admin')->first();

        $accessCatalogs = [
            // Physical Access
            [
                'code' => 'USB_PORT',
                'name' => 'USB Port Access',
                'category' => 'physical',
                'description' => 'Akses penggunaan port USB pada laptop/PC',
                'criticality_level' => 'medium',
                'owner_department_id' => $itDept->id,
                'revocation_procedure' => 'Disable USB port via Group Policy',
            ],
            [
                'code' => 'LAPTOP',
                'name' => 'Laptop/PC Device',
                'category' => 'physical',
                'description' => 'Akses penggunaan device laptop atau PC kantor',
                'criticality_level' => 'high',
                'owner_department_id' => $itDept->id,
                'revocation_procedure' => 'Collect device and disable account',
            ],
            [
                'code' => 'ID_CARD',
                'name' => 'ID Card Building Access',
                'category' => 'physical',
                'description' => 'Kartu akses masuk gedung dan ruangan',
                'criticality_level' => 'high',
                'owner_department_id' => $adminDept->id,
                'revocation_procedure' => 'Deactivate card in access control system',
            ],
            [
                'code' => 'PARKING',
                'name' => 'Parking Access',
                'category' => 'physical',
                'description' => 'Akses parkir karyawan',
                'criticality_level' => 'low',
                'owner_department_id' => $adminDept->id,
                'revocation_procedure' => 'Deactivate parking sticker and access',
            ],

            // Digital Access - Database
            [
                'code' => 'DB_MYSQL',
                'name' => 'Database MySQL',
                'category' => 'digital',
                'description' => 'Akses database MySQL untuk aplikasi internal',
                'criticality_level' => 'critical',
                'owner_department_id' => $itDept->id,
                'revocation_procedure' => 'Revoke MySQL user privileges and drop user',
            ],
            [
                'code' => 'DB_POSTGRES',
                'name' => 'Database PostgreSQL',
                'category' => 'digital',
                'description' => 'Akses database PostgreSQL',
                'criticality_level' => 'critical',
                'owner_department_id' => $itDept->id,
                'revocation_procedure' => 'Revoke PostgreSQL role and drop user',
            ],
            [
                'code' => 'DB_ORACLE',
                'name' => 'Database Oracle',
                'category' => 'digital',
                'description' => 'Akses database Oracle untuk sistem ERP',
                'criticality_level' => 'critical',
                'owner_department_id' => $itDept->id,
                'revocation_procedure' => 'Lock Oracle account and revoke roles',
            ],

            // Network Access
            [
                'code' => 'VPN',
                'name' => 'VPN Remote Access',
                'category' => 'network',
                'description' => 'Akses VPN untuk remote work',
                'criticality_level' => 'high',
                'owner_department_id' => $itDept->id,
                'revocation_procedure' => 'Disable VPN account in firewall',
            ],
            [
                'code' => 'WIFI_CORP',
                'name' => 'WiFi Corporate',
                'category' => 'network',
                'description' => 'Akses WiFi jaringan korporat',
                'criticality_level' => 'medium',
                'owner_department_id' => $itDept->id,
                'revocation_procedure' => 'Remove MAC address from whitelist',
            ],
            [
                'code' => 'FIREWALL',
                'name' => 'Firewall Admin Access',
                'category' => 'network',
                'description' => 'Akses administrasi firewall',
                'criticality_level' => 'critical',
                'owner_department_id' => $itDept->id,
                'revocation_procedure' => 'Remove admin privileges and IP whitelist',
            ],

            // Application Access
            [
                'code' => 'EMAIL_CORP',
                'name' => 'Corporate Email',
                'category' => 'application',
                'description' => 'Akses email korporat (Outlook/Gmail)',
                'criticality_level' => 'high',
                'owner_department_id' => $itDept->id,
                'revocation_procedure' => 'Disable mailbox and set autoreply',
            ],
            [
                'code' => 'ERP_SAP',
                'name' => 'ERP SAP System',
                'category' => 'application',
                'description' => 'Akses sistem ERP SAP',
                'criticality_level' => 'critical',
                'owner_department_id' => $itDept->id,
                'revocation_procedure' => 'Lock SAP user and revoke roles',
            ],
            [
                'code' => 'HRIS',
                'name' => 'HR Information System',
                'category' => 'application',
                'description' => 'Akses sistem informasi HR',
                'criticality_level' => 'high',
                'owner_department_id' => $hrDept->id,
                'revocation_procedure' => 'Disable HRIS account',
            ],
            [
                'code' => 'CRM',
                'name' => 'CRM System',
                'category' => 'application',
                'description' => 'Akses Customer Relationship Management',
                'criticality_level' => 'medium',
                'owner_department_id' => $itDept->id,
                'revocation_procedure' => 'Deactivate CRM user license',
            ],

            // Cloud Access
            [
                'code' => 'AWS_CONSOLE',
                'name' => 'AWS Management Console',
                'category' => 'cloud',
                'description' => 'Akses AWS Console untuk cloud resources',
                'criticality_level' => 'critical',
                'owner_department_id' => $itDept->id,
                'revocation_procedure' => 'Remove IAM user or deactivate access keys',
            ],
            [
                'code' => 'OFFICE365',
                'name' => 'Microsoft Office 365',
                'category' => 'cloud',
                'description' => 'Akses Office 365 (Teams, SharePoint, OneDrive)',
                'criticality_level' => 'high',
                'owner_department_id' => $itDept->id,
                'revocation_procedure' => 'Disable O365 license and block sign-in',
            ],
            [
                'code' => 'GCP',
                'name' => 'Google Cloud Platform',
                'category' => 'cloud',
                'description' => 'Akses GCP Console',
                'criticality_level' => 'critical',
                'owner_department_id' => $itDept->id,
                'revocation_procedure' => 'Remove IAM binding and service accounts',
            ],

            // File Storage
            [
                'code' => 'NAS_FILES',
                'name' => 'NAS File Server',
                'category' => 'file',
                'description' => 'Akses Network Attached Storage',
                'criticality_level' => 'medium',
                'owner_department_id' => $itDept->id,
                'revocation_procedure' => 'Remove SMB/NFS shares and permissions',
            ],
            [
                'code' => 'SHAREPOINT',
                'name' => 'SharePoint Document',
                'category' => 'file',
                'description' => 'Akses dokumen SharePoint',
                'criticality_level' => 'medium',
                'owner_department_id' => $itDept->id,
                'revocation_procedure' => 'Revoke SharePoint permissions',
            ],
            [
                'code' => 'FTP_SFTP',
                'name' => 'FTP/SFTP Server',
                'category' => 'file',
                'description' => 'Akses FTP/SFTP untuk file transfer',
                'criticality_level' => 'medium',
                'owner_department_id' => $itDept->id,
                'revocation_procedure' => 'Disable FTP account and remove SSH keys',
            ],
        ];

        foreach ($accessCatalogs as $catalog) {
            AccessCatalog::create(array_merge($catalog, [
                'created_by' => $superAdmin->id,
                'is_active' => true,
            ]));
        }

        $this->command->info('✅ Access Catalogs seeded successfully!');
        $this->command->info('   Total: ' . count($accessCatalogs) . ' access types');
    }
}