<?php

// Must be first — ensures any fatal/exception outputs a JSON body, not HTML.
// Errors still go to the server log; display is suppressed so they cannot
// corrupt the JSON response body.
ini_set('display_errors', 0);
ini_set('log_errors', 1);
header('Content-Type: application/json; charset=utf-8');

// Last-resort handler for exceptions an engine does not catch itself. Many
// engines call a manager with no try/catch, so any exception — including the
// managers' own deliberate validation messages — used to end as a PHP fatal
// with an empty 500 body, which the browser could only report as "Server
// error occurred." This mirrors the convention the catching engines already
// use: a manager's Exception carries a user-facing message (400); a database
// or engine fault stays generic (500) and goes to the server log.
set_exception_handler(function (Throwable $e) {
    while (ob_get_level() > 0) ob_end_clean();
    if (!headers_sent()) header('Content-Type: application/json; charset=utf-8');

    if ($e instanceof PDOException) {
        error_log('Uncaught PDOException: ' . $e->getMessage() . ' @ ' . $e->getFile() . ':' . $e->getLine());
        http_response_code(500);
        $message = 'Database error, please try again.';
    } elseif ($e instanceof Exception) {
        http_response_code(400);
        $message = $e->getMessage();
    } else {
        // Error / TypeError: a programming fault, not something to show users.
        error_log('Uncaught ' . get_class($e) . ': ' . $e->getMessage() . ' @ ' . $e->getFile() . ':' . $e->getLine());
        http_response_code(500);
        $message = 'Server error occurred.';
    }

    echo json_encode(['success' => 0, 'message' => $message]);
});

require_once __DIR__."/../../config.php";
require_once __DIR__."/../../dbconn.php";
require_once __DIR__."/db_helpers.php";
require_once __DIR__."/app_access.php";

if (!function_exists('require_role')) {
    function require_role(string $user_role, array $allowed): void {
        if (!in_array($user_role, $allowed, true)) {
            http_response_code(403);
            exit(json_encode(['success' => 0, 'message' => 'Access denied.']));
        }
    }
}

if(!empty($_SESSION["login_company_id"])){

    // CSRF Validation — add right at the top of the logged-in block
    if($_SERVER['REQUEST_METHOD'] === 'POST'){
        $csrf_token = $_SERVER['HTTP_X_CSRF_TOKEN'] ?? '';
        if(empty($csrf_token) || !hash_equals((string)($_SESSION['csrf_token'] ?? ''), $csrf_token)){
            http_response_code(403);
            exit(json_encode(["message" => "Invalid request"]));
        }
    }

    // validate otp
    $sql = "SELECT `password`, license, app_access
        FROM user 
        WHERE user_id = :company_id";
    $sth = $pdo1->prepare($sql);
    $sth->execute([
        ":company_id" => $_SESSION["login_user_id"]
    ]);
    db_check($sth, $answer);
    $user_row = $sth->fetch(PDO::FETCH_ASSOC) ?: [];
    $password = $user_row['password'] ?? '';
    /** Generate OTP */
    function generateOTP($sercet_key, $time_step = 180, $length = 6){
        $counter = floor($_SESSION["otpTime"] / $time_step);
        $data = pack("NN", 0, $counter);
        $hash = hash_hmac('sha1', $data, $sercet_key, true);
        $offset = ord(substr($hash, -1)) & 0x0F;
        $value = unpack("N", substr($hash, $offset, 4));
        $otp = ($value[1] & 0x7FFFFFFF) % pow(10, $length);
    
        return str_pad(strval($otp), $length, '0', STR_PAD_LEFT);
    }
    $otp = generateOTP($password);
    
    if( $_SESSION["otp"]!=$otp ){
        http_response_code(401);
        $answer["message"] = "Your password has been reset, Please logout and login again.";
        $answer["code"] = "password_changed";
        exit(json_encode($answer));
    }
    
    // check company accessibily
    $sql = "SELECT * FROM company_map_user WHERE company_id = :login_company_id and user_id = :login_user_id";
    $sth = $pdo1->prepare($sql);
    $sth->execute([
        ":login_company_id" => $_SESSION["login_company_id"],
        ":login_user_id" => $_SESSION["login_user_id"]
    ]);
    db_check($sth, $answer);
    $map = $sth->fetchAll(PDO::FETCH_ASSOC);
    
    if( count($map)==0 ){
        http_response_code(403);
        $answer["message"] = "Your accessibility to this company has been removed.";
        $answer["code"] = "access_removed";
        exit(json_encode($answer));
    }

    $user_role = $map[0]['role'] ?? 'viewer';
    $_SESSION['login_role'] = $user_role;

    // App access (WMS / Accounting), re-read on every request so a change made in
    // Setting → Users applies at once. Owners hold it on their own user row;
    // invited users per company (same rule as login_confirm.php).
    $app_access = (($user_row['license'] ?? 'owner') === 'owner')
        ? ($user_row['app_access'] ?? 'wms')
        : ($map[0]['app_access'] ?? 'wms');
    $_SESSION['login_app_access'] = $app_access;

    $required_app = app_access_app_for($_SERVER['SCRIPT_NAME'] ?? '');
    if ($required_app !== null && !app_access_allows($app_access, $required_app)) {
        http_response_code(403);
        exit(json_encode(['success' => 0, 'message' => 'Your account does not have access to this module.']));
    }

    // Single-session enforcement: if a session_token was issued at login, verify
    // it still matches the DB. A mismatch means a newer login has taken over.
    if (!empty($_SESSION['session_token'])) {
        $sth = $pdo1->prepare("SELECT session_token FROM user WHERE user_id = :uid LIMIT 1");
        $sth->execute([':uid' => $_SESSION['login_user_id']]);
        $db_token = $sth->fetchColumn();
        if ($db_token !== $_SESSION['session_token']) {
            session_destroy();
            http_response_code(401);
            exit(json_encode(['success' => 0, 'message' => 'You have been signed in from another device.', 'code' => 'signed_elsewhere']));
        }

        // Keep session_last_seen fresh (throttled: at most one DB write per 60 s).
        // login_confirm.php reads this to detect when PHP GC has expired the session.
        if (!isset($_SESSION['_last_seen_updated']) || (time() - $_SESSION['_last_seen_updated']) > 60) {
            $pdo1->prepare("UPDATE user SET session_last_seen = NOW() WHERE user_id = :uid AND session_token = :tok")
                 ->execute([':uid' => $_SESSION['login_user_id'], ':tok' => $_SESSION['session_token']]);
            $_SESSION['_last_seen_updated'] = time();
        }
    }

}

// Fail closed — reject any request that arrives without an authenticated session
// unless the engine explicitly declared itself a pre-auth route.
if (empty($_SESSION['login_company_id']) && !defined('UNAUTHENTICATED_ROUTE')) {
    http_response_code(401);
    $expired = !empty($_SESSION['_idle_expired']);
    exit(json_encode([
        'success' => 0,
        'message' => $expired ? 'Your session has expired. Please sign in again.' : 'Authentication required.',
        'code'    => $expired ? 'session_expired' : 'auth_required',
    ]));
}

// set up ANSWER
$answer = array("success"=>0, "message"=>"");

if (isset($_POST['json'])) {
// Old Method: Data is wrapped in a JSON string
$data = json_decode($_POST['json'], true);
if (!is_array($data)) {
    // An undecodable payload used to carry on as an empty request.
    http_response_code(400);
    $answer["message"] = "The request could not be read. Please reload the page and try again.";
    exit(json_encode($answer));
}
} else if (isset($_POST['otp'])) { 
    // New Method: Data is sent directly (FormData)
    // We check for 'otp' because every request should have one
    $data = $_POST;
} else {
    // Truly no data received
    http_response_code(400);
    $answer["message"] = "Request denied: No valid JSON payload or Form Data detected.";
    exit(json_encode($answer));
}

// incase logging in
if(!empty($_SESSION["login_company_id"])){

    $company_id = (int)$_SESSION["login_company_id"];
    $user_id = (int)$_SESSION["login_user_id"];
    $user_role = $_SESSION['login_role'] ?? ($user_role ?? 'viewer');
    $uuid = bin2hex(random_bytes(16));

    // create json for table logging
    $logging = array(
        "user_id" => $user_id,
        "data" => json_encode($data),
        "dt" => date('Y-m-d H:i:s'),
        "login" => date('Y-m-d H:i:s', $_SESSION["otpTime"])
    );

} 

?>