<?php

require_once __DIR__."/../../config.php";
require_once __DIR__."/../../dbconn.php";


/**
 * Check PDO statement for errors
 * Logs full error server-side, returns generic message to client
 *
 * @param PDOStatement $sth      - The executed PDO statement
 * @param array        &$answer  - Response array passed by reference
 * @param array        $options  - Optional settings:
 *                                  'message'     => Custom client-facing error message
 *                                  'log'         => Custom server log label
 *                                  'code'        => HTTP response code (default: 500)
 *                                  'before_exit' => Callback function before exit
 *
 * @example
 * // Simple — use all defaults
 * db_check($sth, $answer);
 *
 * @example
 * // Custom client message
 * db_check($sth, $answer, [
 *     'message' => "Contact not found."
 * ]);
 *
 * @example
 * // Custom log label + message
 * db_check($sth, $answer, [
 *     'log'     => "Failed to fetch contact",
 *     'message' => "Could not load contact. Please try again."
 * ]);
 *
 * @example
 * // Custom HTTP status code
 * db_check($sth, $answer, [
 *     'code'    => 403,
 *     'message' => "Access denied."
 * ]);
 *
 * @example
 * // Cleanup callback before exit
 * db_check($sth, $answer, [
 *     'message'     => "Upload failed.",
 *     'before_exit' => function() use ($tmp_file) {
 *         if(file_exists($tmp_file)) unlink($tmp_file);
 *     }
 * ]);
 */
function db_check($sth, &$answer, $options = []) {
    if ($sth->errorInfo()[0] != "00000" && !empty($sth->errorInfo()[0])) {
        
        $trace = debug_backtrace()[0];
        
        $log_message = $options['log'] ?? "DB Error";
        error_log($log_message . " in " . $trace['file'] . " line " . $trace['line'] . ": " . $sth->errorInfo()[2]);
        
        $answer["message"] = $options['message'] ?? "A server error occurred. Please try again.";
        
        http_response_code($options['code'] ?? 500);
        
        if(isset($options['before_exit'])) {
            call_user_func($options['before_exit']);
        }
        
        exit(json_encode($answer));
    }
}


if(!empty($_SESSION["login_company_id"])){

    // CSRF Validation — add right at the top of the logged-in block
    if($_SERVER['REQUEST_METHOD'] === 'POST'){
        $csrf_token = $_SERVER['HTTP_X_CSRF_TOKEN'] ?? '';
        if(empty($csrf_token) || $csrf_token !== $_SESSION['csrf_token']){
            http_response_code(403);
            exit(json_encode(["message" => "Invalid request"]));
        }
    }

    // validate otp
    $sql = "SELECT `password`
        FROM user 
        WHERE user_id = :company_id";
    $sth = $pdo1->prepare($sql);
    $sth->execute([
        ":company_id" => $_SESSION["login_user_id"]
    ]);
    db_check($sth, $answer);
    $password = $sth->fetchColumn();
    /** Generate OTP */
    function generateOTP($sercet_key, $time_step = 180, $length = 6){
        $counter = floor($_SESSION["otpTime"] / $time_step);
        $data = pack("NN", 0, $counter);
        $hash = hash_hmac('sha1', $data, $sercet_key, true);
        $offset = ord(substr($hash, -1)) & 0x0F;
        $value = unpack("N", substr($hash, $offset, 4));
        $otp = ($value[1] & 0x7FFFFFFF) % pow(10, $length);
    
        return str_pad(strval($otp), $length, '0', STR_PAD_LEFT);
    }
    $otp = generateOTP($password);
    
    if( $_SESSION["otp"]!=$otp ){
        $answer["message"] = "Your password has been reset, Please logout and login again.";
        exit(json_encode($answer));
    }
    
    // check company accessibily
    $sql = "SELECT * FROM company_map_user WHERE company_id = :login_company_id and user_id = :login_user_id";
    $sth = $pdo1->prepare($sql);
    $sth->execute([
        ":login_company_id" => $_SESSION["login_company_id"],
        ":login_user_id" => $_SESSION["login_user_id"]
    ]);
    db_check($sth, $answer);
    $map = $sth->fetchAll(PDO::FETCH_ASSOC);
    
    if( count($map)==0 ){
        $answer["message"] = "Your accessibility to this company has been removed.";
        exit(json_encode($answer));
    }

}

// set up ANSWER
$answer = array("success"=>0, "message"=>"");

if (isset($_POST['json'])) {
// Old Method: Data is wrapped in a JSON string
$data = json_decode($_POST['json'], true);
} else if (isset($_POST['otp'])) { 
    // New Method: Data is sent directly (FormData)
    // We check for 'otp' because every request should have one
    $data = $_POST;
} else {
    // Truly no data received
    $answer["message"] = "Request denied: No valid JSON payload or Form Data detected.";
    exit(json_encode($answer));
}

// incase logging in
if(!empty($_SESSION["login_company_id"])){

    $company_id = (int)$_SESSION["login_company_id"];
    $user_id = (int)$_SESSION["login_user_id"];

    // create json for table logging
    $logging = array(
        "user_id" => $user_id,
        "data" => json_encode($data),
        "dt" => date('Y-m-d H:i:s'),
        "login" => date('Y-m-d H:i:s', $_SESSION["otpTime"])
    );

} 
?>