class SessionsController < ApplicationController
  skip_before_action :require_identified_user, only: %i[new create destroy]

  def new
  end

  def create
    access_key = AccessKey.current

    unless access_key.matches?(session_params[:key])
      Rails.logger.warn("Invalid access key identification attempt for email=#{session_params[:email]}")
      flash.now[:alert] = "The access key is not valid."
      return render :new, status: :unprocessable_entity
    end

    user = find_or_build_user
    return render :new, status: :unprocessable_entity unless user

    sign_in(user)
    redirect_to vehicles_path, notice: "You have been identified."
  end

  def destroy
    sign_out
    redirect_to identify_path, notice: "You have been logged out."
  end

  private

  def session_params
    params.permit(:name, :email, :key)
  end

  def find_or_build_user
    email = session_params[:email].to_s.strip.downcase
    name = session_params[:name].to_s.strip
    user = User.find_by(email: email)

    if user
      return user if user.name == name

      flash.now[:alert] = "The name does not match the existing user for that email."
      return nil
    end

    user = User.new(name: name, email: email)
    return user if user.save

    flash.now[:alert] = user.errors.full_messages.to_sentence
    nil
  end
end