<?php 
	require '../../../session.php'; 
	require '../../../config.php';
	require '../../../preset.php';
	require '../../../assets/utils/db_auth.php';

	// get user_id by username or password
	$sth			= $pdo1->prepare("select user_id from user where ? in (username,email) ");
	$sth->execute(array(strtolower($data["username"])));
	$user_id		= $sth->fetchColumn();

	$username 		= strtolower($data["username"]);
	// get password 
	$sth = $pdo1->prepare("select password from user where username = ? or email = ? limit 1;");
	$sth->execute(array($username,$username));
	$temp = $sth->fetch(PDO::FETCH_ASSOC);

  /**
	 * validate password
	*/
	if(password_verify(trim($data["password"]), $temp["password"])) {

		// create user session
		if( strtolower($data["username"]) == "support" ){
			$s = $pdo1->query("select *, 'info@trcloud.co' as email from user where username='support' limit 1;");
			$r = $s->fetch(PDO::FETCH_ASSOC);
		}else{
			$s = $pdo1->prepare("select * from user where (username=? or email=?) and user_id = ? limit 1;");
			$s->execute(array($username,$username,$user_id));
			$r = $s->fetch(PDO::FETCH_ASSOC);
		}

		// user email
		$user_email = $r["email"];

		if(strpos($user_email,"@")===false){
			$answer["message"] = "<b>".$user_email."</b> is not eligible email, please contact your administrator to change your email.";
			exit(json_encode($answer));
		}

		// ── Block unverified accounts — resend verification email ───
		if ($r["status"] === "pending") {

			// generate fresh token
			$token      = bin2hex(random_bytes(32));
			$expires_at = date('Y-m-d H:i:s', strtotime('+30 days'));

			$sth = $pdo1->prepare("UPDATE user SET verify_token = :token, verify_expires_at = :expires WHERE user_id = :id");
			$sth->execute([':token' => $token, ':expires' => $expires_at, ':id' => $r['user_id']]);

			// build verify URL
			$base_url   = (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] === 'on' ? 'https' : 'http')
			            . '://' . $_SERVER['HTTP_HOST'] . rtrim($server_url, '/');
			$verify_url = $base_url . '/login/verify.php?token=' . $token;

			// send email — silently ignore if it fails, don't expose error to user
			try {
				require_once $include_url . 'assets/utils/module/mailer.php';
				$mailer = new mailer(['pdo1' => $pdo1]);
				$mailer->send_email([
					'company_id'   => 0,
					'smtp'         => $SMTP,
					'to'           => $r['email'],
					'subject'      => 'Verify your email — WMS',
					'message'      => implode("
", [
						"Hi {$r['name']},",
						"",
						"You attempted to login but your email is not yet verified.",
						"Please verify your email address by clicking the button below:",
						"",
						"<a href='{$verify_url}' style='display:inline-block;padding:12px 28px;background:#E66239;color:#ffffff;text-decoration:none;border-radius:6px;font-weight:600;'>Verify Email Address</a>",
						"",
						"Or copy and paste this link into your browser:",
						"<a href='{$verify_url}'>{$verify_url}</a>",
						"",
						"This link will expire in 30 days.",
					]),
					'channel_name' => 'WMS',
					'key'          => $pinkey,
				]);
			} catch (Exception $e) {
				error_log('[resend_verify] ' . $e->getMessage());
			}

			$answer["message"] = "Your email is not verified. We've sent a new verification link to your inbox — please check your email.";
			exit(json_encode($answer));
		}

		if ($r["status"] === "not activated") {
			$answer["message"] = "Your account has been deactivated. Please contact your administrator.";
			exit(json_encode($answer));
		}

		//~ access control
		if( isset($pinform["secure_login"]) && $pinform["secure_login"] == "on" && $_SESSION["license"] != "lord"){
			
			$sth = $pdo1->prepare("select * from whitelist where cookie = :cookie");
			$sth->execute(array(":cookie"=>$data["cookie"]));
			if($sth->rowCount()==0){
				
				$s = $pdo1->prepare("INSERT INTO `whitelist` (`cookie`, `status`, `ip`) VALUES (:cookie, '1', :ip) on duplicate key update ip = values(ip);");
				$s->execute(array(":cookie"=>$data["cookie"],":ip"=>$_SERVER["REMOTE_ADDR"]));
				
				session_destroy();
				$answer["message"] = "wait";
				setcookie("u", "", time()-1, "/");
				setcookie("h1", "", time()-1, "/");
				setcookie("h2", "", time()-1, "/");
				echo json_encode($answer);
				
			}else{
				
				$coo = $sth->fetch(PDO::FETCH_ASSOC);
				if( $coo["status"] == "0" ){
					session_destroy();
					$answer["message"] = "block";
					setcookie("u", "", time()-1, "/");
					setcookie("h1", "", time()-1, "/");
					setcookie("h2", "", time()-1, "/");
					echo json_encode($answer);

					$deviceDecision = [
						'type'   => 'BLOCKED',
						'status' => 0
					];

				}else if( $coo["status"] == "1" ){
					session_destroy();
					$answer["message"] = "wait";
					setcookie("u", "", time()-1, "/");
					setcookie("h1", "", time()-1, "/");
					setcookie("h2", "", time()-1, "/");
					echo json_encode($answer);

					$deviceDecision = [
						'type'   => 'WAIT_APPROVAL',
						'status' => 1
					];
					include __DIR__ . "/api/engine-notification/new_device_login_alert.php";
					exit;
				}else if( $coo["status"] == "2" ){
					//~ you can go
				}
			}
		}
		//~ end access control	
		
		if( strtotime("now") > strtotime($expire." + 1 day") ){
			session_destroy();
			$answer["expire"] = "expire";
			exit(json_encode($answer));
			setcookie("u", "", time()-1, "/");
			setcookie("h1", "", time()-1, "/");
			setcookie("h2", "", time()-1, "/");
		}


		/**
		 * Generate OTP
		 */
		function generateOTP($sercet_key, $time_step = 180, $length = 6){

			global $otpTime;

			$otpTime = time();

			$counter = floor($otpTime / $time_step);
			$data = pack("NN", 0, $counter);
			$hash = hash_hmac('sha1', $data, $sercet_key, true);
			$offset = ord(substr($hash, -1)) & 0x0F;
			$value = unpack("N", substr($hash, $offset, 4));
			$otp = ($value[1] & 0x7FFFFFFF) % pow(10, $length);

			return str_pad(strval($otp), $length, '0', STR_PAD_LEFT);
		}


		function numberToLetters($num) {
			$result = '';
			while ($num > 0) {
					$mod = ($num - 1) % 26;
					$result = chr(65 + $mod) . $result;
					$num = intval(($num - $mod) / 26);
			}
			return str_pad($result, 6, 'A', STR_PAD_LEFT);
		}

		$otp = generateOTP($temp["password"]);

		$reference_number = numberToLetters(generateOTP($otp));

		// ── Look up company SMTP using user's default_company ───────
		$smtp_config     = null;
		$default_company = (int)($r["default_company"] ?? 0);

		if($default_company > 0) {
			$sth = $pdo1->prepare("SELECT * FROM company_smtp WHERE company_id = :cid LIMIT 1");
			$sth->execute([":cid" => $default_company]);
			$smtp_row = $sth->fetch(PDO::FETCH_ASSOC);
			if(!empty($smtp_row)) {
				$smtp_config = $smtp_row;
			}
		}

		// ── SMTP found → send OTP email ──────────────────────────────
		if(!empty($smtp_config)) {

			require "../../../assets/utils/module/mailer.php";

			$mailer = new mailer(["pdo1"=>$pdo1,"pdo2"=>$pdo2]);

			$mailer->send_email([
				"company_id"   => $default_company,
				"smtp"         => $smtp_config,
				"subject"      => "One Time Password (OTP) For reference number ".$reference_number,
				"message"      => "Your OTP is ".$otp." for reference number ".$reference_number,
				"channel_name" => "WMS LOGIN OTP",
				"to"           => $user_email,
				"key"          => $pinkey,
			]);

		}

        $_SESSION = [];

		$_SESSION["login_data"]    = $data;
		$_SESSION["otp"]           = $otp;
		$_SESSION["otpTime"]       = $otpTime;
		$_SESSION["reference"]     = $reference_number;
		$_SESSION["user_email"]    = $user_email;
		$_SESSION["login_user_id"] = $user_id;
		$_SESSION["no_smtp"]       = empty($smtp_config); // flag for login_confirm

		$answer["success"]  = 1;
		$answer["skip_otp"] = empty($smtp_config);
		$answer["message"]  = "Login Complete!";
		exit(json_encode($answer));
	}
	else
	{
		$answer["message"] = "Incorrect Password";
		setcookie("u", "", time()-1, "/");
		setcookie("h1", "", time()-1, "/");
		setcookie("h2", "", time()-1, "/");
		exit(json_encode($answer));
	}

	$answer["success"] = 1;
	exit(json_encode($answer));

?>