<?php

// Must be first — ensures any fatal/exception outputs a JSON body, not HTML.
// Errors still go to the server log; display is suppressed so they cannot
// corrupt the JSON response body.
ini_set('display_errors', 0);
ini_set('log_errors', 1);
header('Content-Type: application/json; charset=utf-8');

require_once __DIR__."/../../config.php";
require_once __DIR__."/../../dbconn.php";
require_once __DIR__."/db_helpers.php";

if (!function_exists('require_role')) {
    function require_role(string $user_role, array $allowed): void {
        if (!in_array($user_role, $allowed, true)) {
            http_response_code(403);
            exit(json_encode(['success' => 0, 'message' => 'Access denied.']));
        }
    }
}

if(!empty($_SESSION["login_company_id"])){

    // CSRF Validation — add right at the top of the logged-in block
    if($_SERVER['REQUEST_METHOD'] === 'POST'){
        $csrf_token = $_SERVER['HTTP_X_CSRF_TOKEN'] ?? '';
        if(empty($csrf_token) || $csrf_token !== $_SESSION['csrf_token']){
            http_response_code(403);
            exit(json_encode(["message" => "Invalid request"]));
        }
    }

    // validate otp
    $sql = "SELECT `password`
        FROM user 
        WHERE user_id = :company_id";
    $sth = $pdo1->prepare($sql);
    $sth->execute([
        ":company_id" => $_SESSION["login_user_id"]
    ]);
    db_check($sth, $answer);
    $password = $sth->fetchColumn();
    /** Generate OTP */
    function generateOTP($sercet_key, $time_step = 180, $length = 6){
        $counter = floor($_SESSION["otpTime"] / $time_step);
        $data = pack("NN", 0, $counter);
        $hash = hash_hmac('sha1', $data, $sercet_key, true);
        $offset = ord(substr($hash, -1)) & 0x0F;
        $value = unpack("N", substr($hash, $offset, 4));
        $otp = ($value[1] & 0x7FFFFFFF) % pow(10, $length);
    
        return str_pad(strval($otp), $length, '0', STR_PAD_LEFT);
    }
    $otp = generateOTP($password);
    
    if( $_SESSION["otp"]!=$otp ){
        $answer["message"] = "Your password has been reset, Please logout and login again.";
        exit(json_encode($answer));
    }
    
    // check company accessibily
    $sql = "SELECT * FROM company_map_user WHERE company_id = :login_company_id and user_id = :login_user_id";
    $sth = $pdo1->prepare($sql);
    $sth->execute([
        ":login_company_id" => $_SESSION["login_company_id"],
        ":login_user_id" => $_SESSION["login_user_id"]
    ]);
    db_check($sth, $answer);
    $map = $sth->fetchAll(PDO::FETCH_ASSOC);
    
    if( count($map)==0 ){
        $answer["message"] = "Your accessibility to this company has been removed.";
        exit(json_encode($answer));
    }

    $user_role = $map[0]['role'] ?? 'viewer';
    $_SESSION['login_role'] = $user_role;

    // Single-session enforcement: if a session_token was issued at login, verify
    // it still matches the DB. A mismatch means a newer login has taken over.
    if (!empty($_SESSION['session_token'])) {
        $sth = $pdo1->prepare("SELECT session_token FROM user WHERE user_id = :uid LIMIT 1");
        $sth->execute([':uid' => $_SESSION['login_user_id']]);
        $db_token = $sth->fetchColumn();
        if ($db_token !== $_SESSION['session_token']) {
            session_destroy();
            http_response_code(401);
            exit(json_encode(['success' => 0, 'message' => 'You have been signed in from another device.', 'code' => 'signed_elsewhere']));
        }
    }

}

// Fail closed — reject any request that arrives without an authenticated session
// unless the engine explicitly declared itself a pre-auth route.
if (empty($_SESSION['login_company_id']) && !defined('UNAUTHENTICATED_ROUTE')) {
    http_response_code(401);
    exit(json_encode(['success' => 0, 'message' => 'Authentication required.']));
}

// set up ANSWER
$answer = array("success"=>0, "message"=>"");

if (isset($_POST['json'])) {
// Old Method: Data is wrapped in a JSON string
$data = json_decode($_POST['json'], true);
} else if (isset($_POST['otp'])) { 
    // New Method: Data is sent directly (FormData)
    // We check for 'otp' because every request should have one
    $data = $_POST;
} else {
    // Truly no data received
    $answer["message"] = "Request denied: No valid JSON payload or Form Data detected.";
    exit(json_encode($answer));
}

// incase logging in
if(!empty($_SESSION["login_company_id"])){

    $company_id = (int)$_SESSION["login_company_id"];
    $user_id = (int)$_SESSION["login_user_id"];
    $user_role = $_SESSION['login_role'] ?? ($user_role ?? 'viewer');
    $uuid = bin2hex(random_bytes(16));

    // create json for table logging
    $logging = array(
        "user_id" => $user_id,
        "data" => json_encode($data),
        "dt" => date('Y-m-d H:i:s'),
        "login" => date('Y-m-d H:i:s', $_SESSION["otpTime"])
    );

} 

?>