<?php

ini_set('display_errors', 1);
ini_set('display_startup_errors', 1);
error_reporting(E_ALL);

use Dotenv\Dotenv;

if (!isset($baseDir)) {
    $baseDir = $_SERVER['DOCUMENT_ROOT'];
}

require_once $baseDir . '/../scripts/session_functions.php';

ini_wkvs_session(true);

$oturl = $_GET['otl'] ?? '';

if (!$oturl) {
    http_response_code(404);
    exit;
}

require $baseDir . '/../scripts/db/db-functions.php';
require $baseDir . '/../scripts/db/db-tables.php';

$error = '';

class otl {

    private function connectToDB() {

        global $mysqli, $baseDir;

        if (isset($mysqli)) { return $mysqli; }

        $_SESSION['access_granted_db_otl'] = true;

        $type = 'otl';

        // DB
        $dbconnection = require $baseDir .'/../scripts/db/db-verbindung-script.php';
        if ($dbconnection['success'] !== true){
            return "DB Error";
        }

        $_SESSION['access_granted_db_otl'] = false;

        return $mysqli;
    }

    private function pwProcessing() {
        
        global $baseDir;

        require $baseDir . '/../composer/vendor/autoload.php';

        $envFile = realpath($baseDir . '/../config/.env.pw-encryption-key');

        if ($envFile === false) {
            http_response_code(500);
            echo json_encode([
                'success' => false,
                'message' => "Environment file not found"
            ]);
            exit;
        }

        try {
            $envDir = dirname($envFile);
            
            $dotenv = Dotenv::createImmutable($envDir, '.env.pw-encryption-key');
            
            $dotenv->load();
        } catch (Throwable $e) {
            http_response_code(500);
            echo json_encode([
                'success' => false,
                'message' => "Dotenv error"
            ]);
        }


        $password = trim($_POST['password1']);
        $passwordRep = trim($_POST['password2']);
        if ($password === '' || $passwordRep === '') {
            return 'Beide Felder müssen ausgefüllt sein';
        }

        if ($password !== $passwordRep) {
            return 'Beide Passwörter müssen identisch sein';
        } 

        $hash = password_hash($password, PASSWORD_ARGON2ID);

        $iv_length = openssl_cipher_iv_length('aes-256-cbc');
        $iv = random_bytes($iv_length);

        $encrypted = openssl_encrypt(
            'SET_BY_OTL',
            'aes-256-cbc',
            $_ENV['PW_ENCRYPTION_KEY'],
            0,
            $iv
        );

        $cipher_store = base64_encode($iv . $encrypted);

        return ['success' => true, 'hash' => $hash, 'encpw' => $cipher_store];
    }

    public function logIn(int $id) {

        global $baseDir;

        $mysqli = $this->connectToDB();

        require $baseDir . '/../scripts/db/db-tables.php';

        // delete the one-time token
        if (!isset($_SESSION['otl_dbid'])) {
            return 'Interner Fehler';
        }

        $dbid = intval($_SESSION['otl_dbid']);

        $stmt = $mysqli->prepare("DELETE FROM $tableOTL WHERE id = ?");
        $stmt->bind_param("i", $dbid);

        if (!$stmt->execute()) {
            return "DB Error";
        }

        $stmt->close();

        $sql = "SELECT freigabe FROM $tableInternUsers WHERE id = ?";

        $stmt = $mysqli->prepare($sql);
        $stmt->bind_param("i", $id);
        $stmt->execute();

        $result = $stmt->get_result();
        $row = $result->fetch_assoc();

        $freigabe = $row['freigabe'];
        $stmt->close();

        $mysqli->close();

        unset($_SESSION['set_new_password_id_user'], $_SESSION['set_new_password_granted'], $_SESSION['otl_dbid']);

        $freigabenArray = json_decode($freigabe, true) ?? [];
        $freigabenTypeArray = $freigabenArray['types'] ?? [];

        if (count($freigabenTypeArray) > 0) { 
            $_SESSION = array(); 
            session_destroy(); 
            session_start(); 
        }

        foreach ($freigabenTypeArray as $freigabeType){
            $_SESSION['access_granted_'.$freigabeType] = true;
            $_SESSION['user_id_'.$freigabeType] = $id;
        }

        var_dump($_SESSION);

        if (in_array('wk_leitung', $freigabenTypeArray)) {
            header("Location: /intern/wk-leitung/logindata");
            exit;
        } elseif (in_array('trainer', $freigabenTypeArray)) {
            header("Location: /intern/trainer");
            exit;
        } elseif (in_array('kampfrichter', $freigabenTypeArray)) {
            header("Location: /intern/kampfrichter");
            exit;
        } else {
            return 'Dieser Benutzer hat keine Berechtigungen.';
        }
    }

    public function resetPW() {

        global $baseDir;

        $iduser = intval($_POST['user_id']);


        // security: user must have passed one-time-login first
        if (empty($_SESSION['set_new_password_id_user']) || empty($_SESSION['set_new_password_granted']) || $_SESSION['set_new_password_id_user'] !== $iduser || $_SESSION['set_new_password_granted'] !== true) {
            http_response_code(403);
            exit;
        }

        require $baseDir . '/../scripts/db/db-tables.php';

        $mysqli = $this->connectToDB();

        $pwArray = $this->pwProcessing();

        if (!isset($pwArray['success']) || !$pwArray['success']) {
            return 'Passwort konnte nicht verarbeitet werden';
        }

        // update password
        $updateResult = db_update($mysqli, $tableInternUsers, ['password_hash' => $pwArray['hash'] ?? '', 'password_cipher' => $pwArray['encpw'] ?? '', 'edited_by' => 'otlogin'], ['id' => $iduser]);
        if ($updateResult === false) {
            return 'Passwork konnte nicht neu gesetzt werden';
        }

        // delete the one-time token
        if (!isset($_SESSION['otl_dbid'])) {
            return 'Interner Fehler';
        }

        $dbid = intval($_SESSION['otl_dbid']);

        $stmt = $mysqli->prepare("DELETE FROM $tableOTL WHERE id = ?");
        $stmt->bind_param("i", $dbid);

        if (!$stmt->execute()) {
            return "DB Error";
        }

        $stmt->close();

        $this->logIn($iduser);
    }

    public function createUser() {

        global $baseDir;

        $iduser = intval($_POST['user_id']);

        if (empty($_SESSION['set_new_user_id_user']) || empty($_SESSION['set_new_user_granted']) || $_SESSION['set_new_user_id_user'] !== $iduser || $_SESSION['set_new_user_granted'] !== true) {
            http_response_code(403);
            exit;
        }

        require $baseDir . '/../scripts/db/db-tables.php';

        $mysqli = $this->connectToDB();

        $arrayDB = [];

        if (isset($_POST['password1'], $_POST['password2'])) {
            $pwArray = $this->pwProcessing();

            if (!isset($pwArray['success']) || !$pwArray['success']) {
                return 'Passwort konnte nicht verarbeitet werden';
            }

            $arrayDB[] = ["name" => 'password_hash', "value" => $pwArray['hash']];
            $arrayDB[] = ["name" => 'password_cipher', "value" => $pwArray['encpw']];
        }

        if (isset($_POST['username'])) {
            $arrayDB[] = ["name" => 'username', "value" => htmlspecialchars(trim($_POST['username']))];
        }

        if (isset($_POST['name_person'])) {
            $arrayDB[] = ["name" => 'name_person', "value" => htmlspecialchars(trim($_POST['name_person']))];
        }

        // --- NEW LOGIC TO UTILIZE $arrayDB ---

        $updateData = [
            'edited_by' => 'otlogin',
            'login_active' => 1
        ];

        // Convert the $arrayDB list into a flat associative array
        if (!empty($arrayDB)) {
            foreach ($arrayDB as $entry) {
                $updateData[$entry['name']] = $entry['value'];
            }
        }

        // Execute update using the dynamically built array
        $updateResult = db_update(
            $mysqli, 
            $tableInternUsers, 
            $updateData, 
            ['id' => $iduser]
        );

        if ($updateResult === false) {
            return 'Nutzer konnte nicht aktualisiert werden';
        }

        $this->logIn($iduser);
    }
}

$pwClass = New otl();

/* ============================================================
   PASSWORD SET ON POST
   ============================================================ */


/* ============================================================
   ONE-TIME-LOGIN VALIDATION (GET)
   ============================================================ */

require $baseDir .'/../scripts/db/db-verbindung-script-guest.php';

// fetch one-time login record
$result = db_select(
    $guest,
    $tableOTL,
    'id, user_id, `type`',
    'url = ? AND timestamp >= NOW() - INTERVAL 24 HOUR',
    [$oturl]
);

if (!$result || count($result) !== 1) {
    echo 'forbidden';
    http_response_code(403);
    exit;
}

$dbid   = intval($result[0]['id']);
$iduser = intval($result[0]['user_id']);

if (isset($_POST['password1'], $_POST['password2'], $_POST['setpasswordbtn'], $_POST['user_id']) && $result[0]['type'] === 'pwreset') { $error = $pwClass->resetPW() ?? ''; }
elseif (isset($_POST['setpasswordbtn'], $_POST['user_id']) && $result[0]['type'] === 'create_profile') { $error = $pwClass->createUser() ?? ''; }

// store dbid for later deletion
$_SESSION['otl_dbid'] = $dbid;

if ($result[0]['type'] === 'login') {
    $pwClass->logIn($iduser);
}

if ($result[0]['type'] === 'pwreset') {
    $userinfo = db_select($guest, $tableInternUsers, 'username', 'id = ?', [$iduser]);
    $username = $userinfo[0]['username'];

    if (!$userinfo || count($userinfo) !== 1) {
        echo 'Ungültige Benutzerinformationen';
        exit;
    }

    // set session token that grants password reset
    $_SESSION['set_new_password_id_user'] = $iduser;
    $_SESSION['set_new_password_granted'] = true;

    $hasUsername = true;
    $hasName = true;


} elseif ($result[0]['type'] === 'create_profile') {
    $userinfo = db_select($guest, $tableInternUsers, 'username, `password_hash`, `name_person`', 'id = ?', [$iduser]);

    if (!$userinfo || count($userinfo) !== 1) {
        echo 'Ungültige Benutzerinformationen';
        exit;
    }

    $hasPW = $userinfo[0]['password_hash'] !== null;
    $hasUsername = $userinfo[0]['username'] !== '';
    $username = $userinfo[0]['username'];
    $hasName = $userinfo[0]['name_person'] !== '';
    
    unset($userinfo);

    // set session token that grants password reset
    $_SESSION['set_new_user_id_user'] = $iduser;
    $_SESSION['set_new_user_granted'] = true;

}
// fetch user

$guest->close();

?>

<!DOCTYPE html>
<html lang="de">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <link rel="icon" type="png" href="/intern/img/icon.png">
    <title>Einmal Login</title>

    <script src="/intern/js/jquery/jquery-3.7.1.min.js"></script>
    <link href="/files/fonts/fonts.css" rel="stylesheet">
    <link href="/intern/css/otl.css" rel="stylesheet">
    <script src="/intern/js/custom-msg-display.js"></script>
    
</head>
<body>
<section class="page-secure-login">
    <div class="bg-picture-secure-login">
        <img src="/intern/img/login/bgOtl.webp">
    </div>
    <div class="bg-secure-login">
        <div class="bg-secure-login-form">
        <h1>Einmal-Login</h1>
        <p style="font-weight:400; line-height: 1.5; margin-bottom: 50px;">
        </p>
        <form method="post">
            <?php if (!$hasUsername) : ?>
                <label for="username">Benutzername</label><br>
                <div class="divShowPw">
                    <input type="text" name="username" id="username" placeholder="Benutzername" required>
                </div><br>
            <?php endif; ?>
            <?php if (!$hasName) : ?>
                <label for="name_person">Name</label><br>
                <div class="divShowPw">
                    <input type="text" name="name_person" id="name_person" placeholder="Max Muster" required>
                </div><br>
            <?php endif; ?>
            <label for="password1">Neues Passwort eingeben</label><br>
            <div class="divShowPw">
                <input type="password" name="password1" id="password1" placeholder="Passwort" required>
                <button type="button" class="togglePassword">
                    <svg class="eyeIcon" xmlns="http://www.w3.org/2000/svg" width="24" height="24" fill="none" stroke="#000" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
                        <path d="M1 12s4-8 11-8 11 8 11 8-4 8-11 8-11-8-11-8z"/>
                        <circle cx="12" cy="12" r="3"/>
                    </svg>
                </button>
            </div><br>
            <label for="password2">Neues Passwort wiederholen</label><br>
            <div class="divShowPw" id="lastDivShowPw">
                <input type="password" name="password2" id="password2" placeholder="Passwort" required>
                <button type="button" class="togglePassword">
                    <svg class="eyeIcon" xmlns="http://www.w3.org/2000/svg" width="24" height="24" fill="none" stroke="#000" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
                        <path d="M1 12s4-8 11-8 11 8 11 8-4 8-11 8-11-8-11-8z"/>
                        <circle cx="12" cy="12" r="3"/>
                    </svg>
                </button>
            </div>
            <input type="hidden" name="user_id" value="<?= $iduser ?>">
            <input type="submit" name="setpasswordbtn" value="Einloggen">
        </form>

        <?php if ($error !== ''): ?>
            <p style="color:red;"><?php echo $error; ?></p>
        <?php endif; ?>
        </div>
    </div>
</section>

<a class="seclog_home_link" href="/"><img src="/intern/img/logo-normal.png" width="64" height="64"></a>

<script>
const toggleButtons = document.querySelectorAll('.togglePassword');

toggleButtons.forEach((el) => {
    el.addEventListener('click', () => {
        const passwordInput = el.parentElement.querySelector("input");
        const eyeIcon = el.querySelector(".eyeIcon");
        const type = passwordInput.getAttribute('type') === 'password' ? 'text' : 'password';
        passwordInput.setAttribute('type', type);

        // Swap between eye and eye-with-line
        if (type === 'password') {
            // Eye (show)
            eyeIcon.innerHTML = '<path d="M1 12s4-8 11-8 11 8 11 8-4 8-11 8-11-8-11-8z"/><circle cx="12" cy="12" r="3"/>';
        } else {
            // Eye with slash (hide)
            eyeIcon.innerHTML = '<path d="M17.94 17.94L6.06 6.06"/><path d="M1 12s4-8 11-8 11 8 11 8-4 8-11 8-11-8-11-8z"/><circle cx="12" cy="12" r="3"/>';
        }
    });
});
</script>
</body>
</html>

<?php /*<form id="setpasswordform" method="post">
    <label for="password">Neues Passwort setzen:</label>
    <input type="text" name="password" id="password" placeholder="Neues Passwort hier eingeben">
    <input name="setpasswordbtn" type="submit" value="Passwort setzen">
</form>*/

?>