<?php
/**
 * Fociz Session Guard API (Release v1.6)
 * Ondersteunt realtime session keepalive, inactiviteitstimeout status en veilige logout
 * Conform NIST SP 800-63B, OWASP ASVS v4.0 en ISO 27001
 */

require_once __DIR__ . '/../includes/auth.php';
require_once __DIR__ . '/../includes/settings.php';

header('Content-Type: application/json; charset=utf-8');

$currentUser = require_auth(true);
$userId = (int)($currentUser['id'] ?? 0);

$action = $_GET['action'] ?? ($_POST['action'] ?? 'keepalive');
$idleTimeout = get_session_idle_timeout();
$now = time();

if ($action === 'keepalive' || $action === 'ping') {
    // Verleng de activiteitstimer van de sessie
    $_SESSION['last_activity'] = $now;
    $_SESSION['last_db_activity_update'] = $now;
    try {
        $db = get_db_connection();
        $stmtAct = $db->prepare("UPDATE users SET last_activity_at = NOW() WHERE id = ?");
        $stmtAct->execute([$userId]);
    } catch (Throwable $e) {}

    echo json_encode([
        'success'   => true,
        'remaining' => $idleTimeout,
        'timeout'   => $idleTimeout,
        'timestamp' => $now
    ], JSON_UNESCAPED_UNICODE);
    exit;
}

if ($action === 'status') {
    $lastActivity = (int)($_SESSION['last_activity'] ?? $now);
    $elapsed = $now - $lastActivity;
    $remaining = max(0, $idleTimeout - $elapsed);

    echo json_encode([
        'success'   => true,
        'remaining' => $remaining,
        'timeout'   => $idleTimeout,
        'timestamp' => $now
    ], JSON_UNESCAPED_UNICODE);
    exit;
}

if ($action === 'logout') {
    try {
        $db = get_db_connection();
        $stmt = $db->prepare("UPDATE users SET remember_token = NULL, remember_token_expires_at = NULL WHERE id = ?");
        $stmt->execute([$userId]);

        fociz_log_audit($userId, 'LOGOUT_SESSION_GUARD', 'users', $userId, ['ip' => fociz_get_client_ip()], 'SUCCESS', $currentUser['email'] ?? null);
    } catch (Throwable $e) {
        error_log("Session guard logout error: " . $e->getMessage());
    }

    clear_day_session_cookie();
    $_SESSION = [];
    if (session_status() === PHP_SESSION_ACTIVE) {
        @session_regenerate_id(true);
        @session_destroy();
    }

    echo json_encode(['success' => true, 'message' => 'Succesvol uitgelogd.'], JSON_UNESCAPED_UNICODE);
    exit;
}

http_response_code(400);
echo json_encode(['success' => false, 'error' => 'Onbekende sessieactie.'], JSON_UNESCAPED_UNICODE);
exit;