<?php
declare(strict_types=1);
namespace App\Controllers;

use App\Core\Auth;
use App\Core\Controller;
use App\Core\Csrf;
use App\Core\Permission;
use App\Services\SecurityIncidentResponseService;

final class SecurityIncidentResponseController extends Controller
{
    public function index(): void
    {
        Auth::requireLogin();
        Permission::require('administration.permissions.view');
        $hours = max(1, min(168, (int)($_GET['hours'] ?? 24)));
        $this->view('security/incidents', [
            'pageTitle'=>'Réponse aux incidents de sécurité',
            'report'=>(new SecurityIncidentResponseService())->dashboard($hours),
        ]);
    }

    public function update(): void
    {
        Auth::requireRecentAuthentication();
        Permission::require('administration.permissions.view');
        Csrf::verify($_POST['_csrf'] ?? null);
        try {
            (new SecurityIncidentResponseService())->update(
                (string)($_POST['incident_id'] ?? ''),
                (string)($_POST['status'] ?? ''),
                (string)($_POST['note'] ?? ''),
                (int)(Auth::id() ?? 0)
            );
            $_SESSION['flash_success'] = 'Traitement de l’incident enregistré.';
        } catch (\Throwable $e) {
            $_SESSION['flash_error'] = $e->getMessage();
        }
        $hours = max(1, min(168, (int)($_POST['hours'] ?? 24)));
        $this->redirect('/administration/securite/incidents?hours=' . $hours);
    }
}
