<?php
/**
 * Fociz Veilige Login met Tweestapsverificatie (2FA)
 */

require_once __DIR__ . '/../includes/auth.php';
start_secure_session();

// Als er nog geen admin is, direct naar setup
if (!has_admin_user()) {
    header('Location: /auth/setup.php');
    exit;
}

// Als de sessie verlopen, ingetrokken of gewijzigd is: beëindig deze direct en wis cookies
if (isset($_GET['expired']) || isset($_GET['revoked']) || isset($_GET['ip_changed'])) {
    if (!empty($_SESSION['user_id'])) {
        fociz_terminate_session(session_id());
    }
    clear_day_session_cookie();
    $_SESSION = [];
    if (session_status() === PHP_SESSION_ACTIVE) {
        @session_regenerate_id(true);
    }
}

// Als al ingelogd (via actieve sessie of persistente cookie), ga direct naar planner
$currentUser = get_logged_in_user();
if ($currentUser) {
    header('Location: /planner.php');
    exit;
}

$error = null;
$infoMessage = null;
if (isset($_GET['expired'])) {
    $infoMessage = "Uw sessie is beëindigd wegens inactiviteit of een dagwissel. Log opnieuw in om verder te gaan.";
}
if (isset($_GET['revoked'])) {
    $infoMessage = "Uw sessie is op afstand beëindigd of ingetrokken. Log opnieuw in om verder te gaan.";
}
if (isset($_GET['ip_changed'])) {
    $infoMessage = "U bent ingelogd vanaf een andere netwerklocatie. Uit veiligheidsoverwegingen dient u opnieuw in te loggen met 2FA.";
}
if (isset($_GET['ip_verified'])) {
    $infoMessage = "Nieuwe inloglocatie succesvol geverifieerd! U kunt nu veilig inloggen.";
}
$step = isset($_SESSION['pending_2fa_user_id']) ? 2 : 1;

// Terug naar stap 1
if (isset($_GET['action']) && $_GET['action'] === 'restart') {
    unset($_SESSION['pending_2fa_user_id'], $_SESSION['pending_2fa_user_email'], $_SESSION['pending_2fa_user_name'], $_SESSION['pending_new_ip']);
    header('Location: /auth/login.php');
    exit;
}

// POST Verwerking
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $db = get_db_connection();
    $clientIp = fociz_get_client_ip();
    $ipRateKey = "login_ip_{$clientIp}";
    $ipLimit = fociz_check_rate_limit($ipRateKey, 10, 900);

    if (!verify_csrf_token($_POST['csrf_token'] ?? null)) {
        $error = "Sessie verlopen of beveiligingstoken ongeldig. Ververs de pagina en probeer opnieuw.";
    } elseif (!$ipLimit['allowed']) {
        $error = "Te veel inlogpogingen vanaf dit netwerkadres. Probeer het over " . ceil($ipLimit['retry_after'] / 60) . " minuten opnieuw.";
    } elseif ($step === 1) {
        // STAP 1: Wachtwoord verificatie
        $email = strtolower(trim($_POST['email'] ?? ''));
        $password = $_POST['password'] ?? '';
        $emailRateKey = "login_email_{$email}";
        $emailLimit = fociz_check_rate_limit($emailRateKey, 5, 900);

        if (!$emailLimit['allowed']) {
            $error = "Dit account is tijdelijk geblokkeerd wegens te veel mislukte pogingen. Probeer het over " . ceil($emailLimit['retry_after'] / 60) . " minuten opnieuw.";
        } elseif (empty($email) || empty($password)) {
            $error = "Vul e-mailadres en wachtwoord in.";
        } else {
            $stmt = $db->prepare("SELECT id, name, email, password_hash, two_factor_secret, two_factor_enabled FROM users WHERE email = ?");
            $stmt->execute([$email]);
            $user = $stmt->fetch();

            if ($user && password_verify($password, $user['password_hash'])) {
                fociz_clear_rate_limit($emailRateKey);
                // Controleer of de inloglocatie/IP bekend is
                $isIpKnown = fociz_is_ip_known_for_user((int)$user['id'], $clientIp);

                if (!$isIpKnown) {
                    // Stuur verificatie-mail en informeer gebruiker
                    fociz_send_new_ip_verification((int)$user['id'], $user['email'], $user['name'], $clientIp);
                    fociz_log_audit((int)$user['id'], 'LOGIN_NEW_IP_CHALLENGE', 'user', (int)$user['id'], ['ip' => $clientIp], 'PENDING', $user['email']);
                    $error = "Nieuwe inloglocatie gedetecteerd ({$clientIp}). Er is een verificatie-e-mail gestuurd naar {$user['email']}. Klik op de link in de e-mail om deze locatie toe te staan.";
                } else {
                    // Succesvol stap 1: zet tijdelijke pending sessie voor 2FA
                    $_SESSION['pending_2fa_user_id'] = $user['id'];
                    $_SESSION['pending_2fa_user_email'] = $user['email'];
                    $_SESSION['pending_2fa_user_name'] = $user['name'];
                    $step = 2;
                }
            } else {
                fociz_hit_rate_limit($ipRateKey, 900);
                if (!empty($email)) {
                    fociz_hit_rate_limit($emailRateKey, 900);
                }
                fociz_log_audit($user ? (int)$user['id'] : null, 'LOGIN_FAILED', 'user', $user ? (int)$user['id'] : null, ['reason' => 'Invalid credentials', 'ip' => $clientIp], 'FAILURE', $email);
                $error = "Onjuist e-mailadres of wachtwoord.";
            }
        }
    }
    // STAP 2: 2FA TOTP Code verificatie
    elseif ($step === 2) {
        $userId = $_SESSION['pending_2fa_user_id'] ?? null;
        $totpCode = trim($_POST['totp_code'] ?? '');

        if (!$userId) {
            header('Location: /auth/login.php');
            exit;
        }

        $totpRateKey = "login_totp_{$userId}";
        $totpLimit = fociz_check_rate_limit($totpRateKey, 5, 900);

        if (!$totpLimit['allowed']) {
            $error = "Te veel ongeldige verificatiecodes. Probeer het over " . ceil($totpLimit['retry_after'] / 60) . " minuten opnieuw.";
        } elseif (empty($totpCode)) {
            $error = "Vul de 6-cijferige 2FA code in uit uw authenticator app.";
        } else {
            $stmt = $db->prepare("SELECT * FROM users WHERE id = ?");
            $stmt->execute([$userId]);
            $user = $stmt->fetch();

            $isValid = false;

            // Controleer reguliere TOTP code
            if (!empty($user['two_factor_secret'])) {
                try {
                    $isValid = TOTP::verifyCode($user['two_factor_secret'], $totpCode);
                } catch (Throwable $t) {
                    error_log("TOTP verificatiefout: " . $t->getMessage());
                    $isValid = false;
                }
            }

            // Fallback: controleer 8-karakter backup codes
            if (!$isValid && !empty($user['backup_codes'])) {
                $backupCodes = json_decode($user['backup_codes'], true) ?: [];
                $codeUpper = strtoupper($totpCode);
                $key = array_search($codeUpper, $backupCodes);
                if ($key !== false) {
                    $isValid = true;
                    // Verbruik de backup code
                    unset($backupCodes[$key]);
                    $stmtUpdate = $db->prepare("UPDATE users SET backup_codes = ? WHERE id = ?");
                    $stmtUpdate->execute([json_encode(array_values($backupCodes)), $userId]);
                }
            }

            if ($isValid) {
                fociz_clear_rate_limit($totpRateKey);
                fociz_clear_rate_limit($ipRateKey);

                // Volledige login succesvol (geldig tot 23:59:59 van vandaag)
                fociz_register_user_ip((int)$user['id'], $clientIp, true);

                // Session Fixation Beveiliging (OWASP ASVS v4.0 §3.3.1 / SOC 2 CC6.6):
                // Genereer direct een nieuw cryptografisch sessie-ID en vernietig de pre-auth sessie
                if (session_status() === PHP_SESSION_ACTIVE) {
                    session_regenerate_id(true);
                }
                $newSessionId = session_id();

                $_SESSION['user_id'] = $user['id'];
                $_SESSION['user_name'] = $user['name'];
                $_SESSION['user_email'] = $user['email'];
                $_SESSION['user_role'] = $user['role'];
                $_SESSION['is_2fa_verified'] = true;
                $_SESSION['auth_date'] = date('Y-m-d');
                $_SESSION['auth_fingerprint'] = fociz_get_client_fingerprint();
                $_SESSION['session_expires_at'] = strtotime('today 23:59:59');
                $_SESSION['last_activity'] = time();
                $_SESSION['login_time'] = time();
                $_SESSION['last_rotated'] = time();

                // Dagsessie-token uitgeven (strikt geldig tot 23:59:59 van vandaag)
                issue_day_session_token((int)$user['id']);

                // Registreer actieve sessie in user_sessions (SOC 2 / ISO 27001)
                $maxIdleSeconds = function_exists('get_session_idle_timeout') ? get_session_idle_timeout() : 1800;
                fociz_register_active_session((int)$user['id'], $newSessionId, $maxIdleSeconds);

                fociz_log_audit((int)$user['id'], 'LOGIN_SUCCESS', 'user', (int)$user['id'], ['ip' => $clientIp, 'auth_method' => 'PASSWORD+2FA'], 'SUCCESS', $user['email']);

                unset($_SESSION['pending_2fa_user_id'], $_SESSION['pending_2fa_user_email'], $_SESSION['pending_2fa_user_name']);

                header('Location: /planner.php');
                exit;
            } else {
                fociz_hit_rate_limit($totpRateKey, 900);
                fociz_hit_rate_limit($ipRateKey, 900);
                fociz_log_audit((int)$userId, 'LOGIN_MFA_FAILED', 'user', (int)$userId, ['ip' => $clientIp], 'FAILURE', $_SESSION['pending_2fa_user_email'] ?? null);
                $error = "Onjuiste 2FA code. Controleer uw authenticator app en probeer opnieuw.";
            }
        }
    }
}

$pageTitle = "Fociz — Inloggen";
?>
<!DOCTYPE html>
<html lang="nl" class="dark">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title><?= htmlspecialchars($pageTitle) ?></title>
    <link rel="icon" type="image/svg+xml" href="/assets/favicon.svg">
    <link rel="alternate icon" href="/favicon.ico">
    <!-- Anti-flicker script: Laad direct het gekozen thema uit localStorage vóór DOM render -->
    <script>
        (function() {
            var activeTheme = localStorage.getItem('fociz_theme') || 'dark';
            var isDark = true;
            if (activeTheme === 'dark') isDark = true;
            else if (activeTheme === 'light') isDark = false;
            else if (activeTheme === 'system') {
                isDark = window.matchMedia && window.matchMedia('(prefers-color-scheme: dark)').matches;
            }
            if (isDark) document.documentElement.classList.add('dark');
            else document.documentElement.classList.remove('dark');
        })();
    </script>
    <script src="https://cdn.tailwindcss.com"></script>
    <script>
        tailwind.config = {
            darkMode: 'class',
            theme: {
                extend: {
                    colors: {
                        slate: {
                            850: '#151f32',
                            950: '#070b12',
                        }
                    }
                }
            }
        }
    </script>
    <script src="https://unpkg.com/lucide@latest"></script>
    <link rel="preconnect" href="https://fonts.googleapis.com">
    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
    <link href="https://fonts.googleapis.com/css2?family=Plus+Jakarta+Sans:wght@300;400;500;600;700;800&display=swap" rel="stylesheet">
    <style>
        body { font-family: 'Plus Jakarta Sans', sans-serif; }
    </style>
</head>
<body class="min-h-screen flex items-center justify-center p-4 bg-[#f8fafc] dark:bg-[#0c0f17] text-slate-900 dark:text-slate-100 transition-colors">

<?php require_once __DIR__ . '/../includes/env_badge.php'; ?>

<div class="w-full max-w-md bg-white dark:bg-[#111622] border border-slate-200 dark:border-slate-800/80 rounded-2xl shadow-xs backdrop-blur-xl p-8 transition">
    <!-- Header -->
    <div class="text-center mb-8">
        <div class="inline-flex items-center justify-center w-14 h-14 rounded-2xl bg-indigo-50 dark:bg-indigo-950/40 border border-indigo-200 dark:border-indigo-800/60 text-indigo-600 dark:text-indigo-400 mb-3 shadow-xs">
            <i data-lucide="shield-check" class="w-8 h-8"></i>
        </div>
        <h1 class="text-3xl font-black tracking-tight text-slate-900 dark:text-white">Fociz</h1>
        <p class="text-slate-500 dark:text-slate-400 text-sm mt-1">
            Veilig inloggen met tweestapsverificatie (2FA)
        </p>
    </div>

    <?php if ($infoMessage): ?>
        <div class="mb-6 p-4 rounded-2xl bg-sky-500/10 border border-sky-500/30 flex items-start space-x-3 text-sky-800 dark:text-sky-300 text-xs sm:text-sm">
            <i data-lucide="info" class="w-5 h-5 flex-shrink-0 mt-0.5 text-sky-600 dark:text-sky-400"></i>
            <span><?= htmlspecialchars($infoMessage) ?></span>
        </div>
    <?php endif; ?>

    <?php if ($error): ?>
        <div class="mb-6 p-4 rounded-2xl bg-red-500/10 border border-red-500/30 flex items-start space-x-3 text-red-700 dark:text-red-400 text-sm">
            <i data-lucide="alert-triangle" class="w-5 h-5 flex-shrink-0 mt-0.5"></i>
            <span><?= htmlspecialchars($error) ?></span>
        </div>
    <?php endif; ?>

    <?php if ($step === 1): ?>
        <!-- STAP 1: E-mail & Wachtwoord -->
        <form method="POST" action="/auth/login.php" class="space-y-4">
            <input type="hidden" name="csrf_token" value="<?= htmlspecialchars(get_csrf_token()) ?>">
            <div>
                <label class="block text-xs font-semibold text-slate-700 dark:text-slate-300 mb-1">E-mailadres</label>
                <div class="relative">
                    <input type="email" name="email" required autofocus placeholder="uw.naam@bedrijf.nl" value="<?= htmlspecialchars($_POST['email'] ?? '') ?>" class="w-full bg-slate-50 dark:bg-[#0c0f17] border border-slate-300 dark:border-slate-800 rounded-xl px-4 py-2.5 text-slate-900 dark:text-white placeholder-slate-400 dark:placeholder-slate-500 focus:outline-none focus:ring-1 focus:ring-indigo-500 text-sm transition">
                </div>
            </div>

            <div>
                <div class="flex items-center justify-between mb-1">
                    <label class="block text-xs font-semibold text-slate-700 dark:text-slate-300">Wachtwoord</label>
                    <a href="/auth/forgot-password.php" class="text-xs text-indigo-600 dark:text-indigo-400 hover:underline font-medium">Wachtwoord vergeten?</a>
                </div>
                <div class="relative">
                    <input type="password" name="password" required placeholder="••••••••" class="w-full bg-slate-50 dark:bg-[#0c0f17] border border-slate-300 dark:border-slate-800 rounded-xl px-4 py-2.5 text-slate-900 dark:text-white placeholder-slate-400 dark:placeholder-slate-500 focus:outline-none focus:ring-1 focus:ring-indigo-500 text-sm transition">
                </div>
            </div>

            <button type="submit" class="w-full mt-4 bg-indigo-600 hover:bg-indigo-500 text-white font-bold py-3 px-4 rounded-xl transition shadow-xs flex items-center justify-center space-x-2 cursor-pointer">
                <span>Verder naar 2FA</span>
                <i data-lucide="arrow-right" class="w-4 h-4"></i>
            </button>
        </form>

    <?php else: ?>

        <!-- STAP 2: 2FA TOTP Code -->
        <form method="POST" action="/auth/login.php" class="space-y-5">
            <input type="hidden" name="csrf_token" value="<?= htmlspecialchars(get_csrf_token()) ?>">
            <div class="text-center">
                <div class="inline-flex items-center justify-center w-12 h-12 rounded-xl bg-indigo-50 dark:bg-indigo-950/40 text-indigo-600 dark:text-indigo-400 mb-2">
                    <i data-lucide="key" class="w-6 h-6"></i>
                </div>
                <p class="text-sm text-slate-800 dark:text-slate-300 font-semibold">
                    Voer uw 6-cijferige verificatiecode in
                </p>
                <p class="text-xs text-slate-500 dark:text-slate-400 mt-1">
                    Gekoppeld aan <strong class="text-slate-900 dark:text-slate-200"><?= htmlspecialchars($_SESSION['pending_2fa_user_email'] ?? '') ?></strong>
                </p>
            </div>

            <div>
                <input type="text" name="totp_code" required autofocus maxlength="6" inputmode="numeric" autocomplete="one-time-code" placeholder="000 000" class="w-full text-center tracking-[0.4em] font-mono text-2xl bg-slate-50 dark:bg-[#0c0f17] border border-slate-300 dark:border-slate-800 rounded-xl py-3 text-slate-900 dark:text-white placeholder-slate-400 dark:placeholder-slate-600 focus:outline-none focus:ring-1 focus:ring-indigo-500 transition">
            </div>

            <div class="flex space-x-3">
                <a href="/auth/login.php?action=restart" class="w-1/3 text-center bg-slate-100 hover:bg-slate-200 dark:bg-slate-800 dark:hover:bg-slate-700 text-slate-700 dark:text-slate-300 font-medium py-2.5 px-3 rounded-xl transition text-sm flex items-center justify-center cursor-pointer">
                    Terug
                </a>
                <button type="submit" class="w-2/3 bg-indigo-600 hover:bg-indigo-500 text-white font-bold py-2.5 px-4 rounded-xl transition shadow-xs flex items-center justify-center space-x-2 cursor-pointer">
                    <span>Inloggen</span>
                    <i data-lucide="check-circle-2" class="w-4 h-4"></i>
                </button>
            </div>
        </form>

    <?php endif; ?>

    <div class="mt-8 pt-6 border-t border-slate-100 dark:border-slate-800/80 text-center text-xs text-slate-500">
        Toegang tot Fociz is strikt op uitnodiging. Vraag uw beheerder om een uitnodigingslink.
    </div>
</div>

<script>
    try {
        localStorage.removeItem('fociz_session_last_activity');
        localStorage.removeItem('fociz_session_logged_out');
    } catch(e) {}
    if (typeof lucide !== 'undefined') lucide.createIcons();
</script>
</body>
</html>