<?php
/**
 * Authenticatie & Autorisatie Guard voor Fociz
 */

require_once __DIR__ . '/../config/database.php';
require_once __DIR__ . '/totp.php';

function start_secure_session(): void {
    if (session_status() === PHP_SESSION_NONE) {
        // Veilige sessiecookie parameters
        $isSecure = (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] === 'on');
        session_set_cookie_params([
            'lifetime' => 7 * 24 * 60 * 60, // 7 dagen
            'path' => '/',
            'secure' => $isSecure,
            'httponly' => true,
            'samesite' => 'Lax'
        ]);
        session_start();
    }
}

/**
 * Controleert of er al een beheerder bestaat in MariaDB
 */
function has_admin_user(): bool {
    try {
        $db = get_db_connection();
        $stmt = $db->query("SELECT COUNT(*) FROM users WHERE role = 'ADMIN'");
        return ((int)$stmt->fetchColumn()) > 0;
    } catch (Throwable $e) {
        return false;
    }
}

/**
 * Haalt de huidige ingelogde gebruiker op uit de database
 */
function get_logged_in_user(): ?array {
    start_secure_session();

    if (empty($_SESSION['user_id']) || empty($_SESSION['is_2fa_verified'])) {
        return null;
    }

    $db = get_db_connection();
    $stmt = $db->prepare("SELECT id, name, email, role, two_factor_enabled, created_at FROM users WHERE id = ?");
    $stmt->execute([$_SESSION['user_id']]);
    $user = $stmt->fetch();

    return $user ?: null;
}

/**
 * Beschermt pagina's: dwingt login + 2FA af
 */
function require_auth(): array {
    start_secure_session();

    // 1. Controleer of eerste setup nodig is
    if (!has_admin_user()) {
        header('Location: /auth/setup.php');
        exit;
    }

    // 2. Controleer of gebruiker ingelogd én 2FA geverifieerd is
    $user = get_logged_in_user();
    if (!$user) {
        header('Location: /auth/login.php');
        exit;
    }

    return $user;
}

/**
 * Dwingt beheerder (ADMIN) rol af
 */
function require_admin(): array {
    $user = require_auth();
    if ($user['role'] !== 'ADMIN') {
        header('Location: /planner.php');
        exit;
    }
    return $user;
}

/**
 * Maakt een nieuwe uitnodiging aan voor een collega
 */
function create_invite(int $createdById, string $email, string $role = 'MEMBER'): string {
    $db = get_db_connection();
    $token = bin2hex(random_bytes(24));
    $expiresAt = date('Y-m-d H:i:s', strtotime('+7 days'));

    $stmt = $db->prepare("INSERT INTO invites (token, email, role, expires_at, created_by_id) VALUES (?, ?, ?, ?, ?)");
    $stmt->execute([$token, strtolower(trim($email)), $role, $expiresAt, $createdById]);

    return $token;
}

/**
 * Valideert een invite token
 */
function validate_invite(string $token): ?array {
    $db = get_db_connection();
    $stmt = $db->prepare("
        SELECT i.*, u.name as inviter_name, u.email as inviter_email 
        FROM invites i
        JOIN users u ON i.created_by_id = u.id
        WHERE i.token = ?
    ");
    $stmt->execute([$token]);
    $invite = $stmt->fetch();

    if (!$invite) return null;
    if ($invite['used_at'] !== null) return null;
    if (strtotime($invite['expires_at']) < time()) return null;

    return $invite;
}

/**
 * CSRF token helpers
 */
function get_csrf_token(): string {
    start_secure_session();
    if (empty($_SESSION['csrf_token'])) {
        $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
    }
    return $_SESSION['csrf_token'];
}

function verify_csrf_token(?string $token): bool {
    start_secure_session();
    return !empty($token) && !empty($_SESSION['csrf_token']) && hash_equals($_SESSION['csrf_token'], $token);
}