<?php

namespace App\Actions;

use App\Enums\SocialProvider;
use App\Models\User;
use App\Services\AppleOAuthTokenClient;
use Illuminate\Contracts\Encryption\DecryptException;

class RevokeSocialAuthorizations
{
    public function __construct(private AppleOAuthTokenClient $appleOAuthTokenClient) {}

    public function execute(User $user): void
    {
        $appleAccount = $user->socialAccounts()
            ->where('provider', SocialProvider::Apple)
            ->first();

        if (! $appleAccount) {
            return;
        }

        try {
            $refreshToken = $appleAccount->provider_refresh_token;
        } catch (DecryptException) {
            abort(503, 'SOCIAL_REVOCATION_FAILED');
        }

        if (! is_string($refreshToken) || $refreshToken === '') {
            abort(409, 'SOCIAL_REVOCATION_TOKEN_MISSING');
        }

        $this->appleOAuthTokenClient->revoke($refreshToken);
    }
}