<?php

declare(strict_types=1);

namespace apexl\Io\modules\user\enums;

/**
 * Platform-wide 2FA mode (config `auth.two_factor.mode`).
 *
 * - OFF: no setup offered, enforcement short-circuits — zero behavioural change.
 * - OPTIONAL: users may opt in; only users with an active method are gated.
 * - ENFORCED: every user must hold an active method; the absence of one is
 *   itself a blocking condition (subject to the grace period).
 */
enum TwoFactorMode: string
{
    case OFF = 'off';
    case OPTIONAL = 'optional';
    case ENFORCED = 'enforced';

    /**
     * Resolve a config value to a mode, defaulting UNKNOWN/empty to OFF so a
     * mis-set env can never accidentally enable enforcement.
     */
    public static function fromConfigValue(mixed $value): self
    {
        if ($value instanceof self) {
            return $value;
        }

        return self::tryFrom(is_string($value) ? strtolower(trim($value)) : '') ?? self::OFF;
    }

    public function isOff(): bool
    {
        return $this === self::OFF;
    }
}
