<?php
require_once __DIR__ . '/../config/db.php';

$action = $_GET['action'] ?? '';

// Check current session
if ($action === 'check') {
    if (isset($_SESSION['user'])) {
        sendResponse(true, ['user' => $_SESSION['user']]);
    }
    sendResponse(false, 'Not logged in', 200);
}

// Login
if ($action === 'login' && $_SERVER['REQUEST_METHOD'] === 'POST') {
    $input = getJsonInput();
    $username = trim($input['username'] ?? '');
    $password = $input['password'] ?? '';

    if (empty($username) || empty($password)) {
        sendResponse(false, 'กรุณาระบุชื่อผู้ใช้และรหัสผ่าน', 400);
    }

    $stmt = $pdo->prepare("SELECT * FROM users WHERE username = :u OR email = :u LIMIT 1");
    $stmt->execute(['u' => $username]);
    $user = $stmt->fetch();

    if (!$user || !password_verify($password, $user['password'])) {
        sendResponse(false, 'ชื่อผู้ใช้หรือรหัสผ่านไม่ถูกต้อง', 400);
    }

    if (!empty($user['is_banned'])) {
        sendResponse(false, 'บัญชีของคุณถูกระงับการใช้งานชั่วคราว', 403);
    }

    unset($user['password']);
    $_SESSION['user'] = $user;
    sendResponse(true, ['message' => 'เข้าสู่ระบบสำเร็จ', 'user' => $user]);
}

// Register
if ($action === 'register' && $_SERVER['REQUEST_METHOD'] === 'POST') {
    $input = getJsonInput();
    $username = trim($input['username'] ?? '');
    $password = $input['password'] ?? '';
    $email = trim($input['email'] ?? '');
    $name = trim($input['name'] ?? $username);
    $role = in_array($input['role'] ?? '', ['client', 'seller']) ? $input['role'] : 'client';
    $shopName = ($role === 'seller') ? ($input['shop_name'] ?? $name) : null;

    if (empty($username) || empty($password) || empty($email)) {
        sendResponse(false, 'กรุณากรอกข้อมูลให้ครบถ้วน', 400);
    }

    $check = $pdo->prepare("SELECT id FROM users WHERE username = ? OR email = ?");
    $check->execute([$username, $email]);
    if ($check->rowCount() > 0) {
        sendResponse(false, 'ชื่อผู้ใช้หรืออีเมลนี้มีอยู่ในระบบแล้ว', 400);
    }

    $hashed = password_hash($password, PASSWORD_DEFAULT);
    $stmt = $pdo->prepare("INSERT INTO users (username, password, email, name, role, shop_name) VALUES (?, ?, ?, ?, ?, ?)");
    $stmt->execute([$username, $hashed, $email, $name, $role, $shopName]);

    sendResponse(true, 'สมัครสมาชิกเรียบร้อยแล้ว');
}

// Logout
if ($action === 'logout') {
    $_SESSION = [];
    if (ini_get("session.use_cookies")) {
        $params = session_get_cookie_params();
        setcookie(session_name(), '', time() - 42000,
            $params["path"], $params["domain"],
            $params["secure"], $params["httponly"]
        );
    }
    session_destroy();
    sendResponse(true, 'ออกจากระบบสำเร็จ');
}