<?php
/**
 * User Profile Page
 * CMTC Shopping
 */
require_once __DIR__ . '/../includes/header.php';
require_once __DIR__ . '/../includes/navbar.php';

require_login();

$user_id = $_SESSION['user_id'];
$error = "";
$success = "";

// Handle Profile Update
if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['update_profile'])) {
    if (!validate_csrf_token($_POST['csrf_token'] ?? '')) {
        $error = "โทเค็นความปลอดภัยไม่ถูกต้อง";
    } else {
        $prefix = trim($_POST['prefix'] ?? '');
        $firstname = trim($_POST['firstname'] ?? '');
        $lastname = trim($_POST['lastname'] ?? '');
        $phone = trim($_POST['phone'] ?? '');
        $email = trim($_POST['email'] ?? '');
        $address = trim($_POST['address'] ?? '');

        if (empty($firstname) || empty($lastname)) {
            $error = "กรุณากรอกชื่อและนามสกุล";
        } else {
            try {
                // Handle avatar upload
                $avatar_name = null;
                if (isset($_FILES['avatar']) && $_FILES['avatar']['error'] === UPLOAD_ERR_OK) {
                    $upload_res = upload_image($_FILES['avatar'], '', 'avatar');
                    if ($upload_res['success']) {
                        $avatar_name = $upload_res['filename'];
                        $_SESSION['avatar'] = $avatar_name;
                    } else {
                        $error = $upload_res['error'];
                    }
                }

                if (empty($error)) {
                    if ($avatar_name) {
                        $stmt_upd = $db->prepare("UPDATE users SET prefix = ?, firstname = ?, lastname = ?, phone = ?, email = ?, address = ?, avatar = ? WHERE id = ?");
                        $stmt_upd->execute([$prefix, $firstname, $lastname, $phone, $email, $address, $avatar_name, $user_id]);
                    } else {
                        $stmt_upd = $db->prepare("UPDATE users SET prefix = ?, firstname = ?, lastname = ?, phone = ?, email = ?, address = ? WHERE id = ?");
                        $stmt_upd->execute([$prefix, $firstname, $lastname, $phone, $email, $address, $user_id]);
                    }

                    $_SESSION['fullname'] = $prefix . $firstname . ' ' . $lastname;
                    $success = "บันทึกข้อมูลส่วนตัวเรียบร้อยแล้ว";
                }
            } catch (Exception $e) {
                $error = "เกิดข้อผิดพลาด: " . $e->getMessage();
            }
        }
    }
}

// Handle Password Change
if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['change_password'])) {
    if (!validate_csrf_token($_POST['csrf_token'] ?? '')) {
        $error = "โทเค็นความปลอดภัยไม่ถูกต้อง";
    } else {
        $old_pass = $_POST['old_password'] ?? '';
        $new_pass = $_POST['new_password'] ?? '';
        $confirm_pass = $_POST['confirm_password'] ?? '';

        if (empty($old_pass) || empty($new_pass) || empty($confirm_pass)) {
            $error = "กรุณากรอกข้อมูลรหัสผ่านให้ครบทุกช่อง";
        } elseif ($new_pass !== $confirm_pass) {
            $error = "รหัสผ่านใหม่และการยืนยันรหัสผ่านไม่ตรงกัน";
        } elseif (strlen($new_pass) < 6) {
            $error = "รหัสผ่านใหม่ต้องมีความยาวอย่างน้อย 6 ตัวอักษร";
        } else {
            $stmt = $db->prepare("SELECT password FROM users WHERE id = ?");
            $stmt->execute([$user_id]);
            $current_hash = $stmt->fetchColumn();

            if (password_verify($old_pass, $current_hash)) {
                $new_hash = password_hash($new_pass, PASSWORD_BCRYPT);
                $stmt_p = $db->prepare("UPDATE users SET password = ? WHERE id = ?");
                $stmt_p->execute([$new_hash, $user_id]);
                $success = "เปลี่ยนรหัสผ่านเรียบร้อยแล้ว";
            } else {
                $error = "รหัสผ่านเดิมไม่ถูกต้อง";
            }
        }
    }
}

// Fetch current user details
$stmt_u = $db->prepare("
    SELECT u.*, r.name as role_name, d.name as department_name 
    FROM users u 
    LEFT JOIN user_roles r ON u.role_id = r.id 
    LEFT JOIN departments d ON u.department_id = d.id 
    WHERE u.id = ?
");
$stmt_u->execute([$user_id]);
$user = $stmt_u->fetch();
?>

<div class="container my-5">
    <div class="row g-4">
        <div class="col-md-4">
            <div class="card border-0 shadow-sm glass-card p-4 text-center">
                <div class="mb-3">
                    <?php if (!empty($user['avatar'])): ?>
                        <img src="<?php echo base_url('uploads/' . sanitize($user['avatar'])); ?>" class="rounded-circle shadow" width="120" height="120" style="object-fit: cover;">
                    <?php else: ?>
                        <div class="bg-primary text-white rounded-circle d-flex align-items-center justify-content-center mx-auto shadow" style="width: 120px; height: 120px; font-size: 3rem;">
                            <i class="bi bi-person-fill"></i>
                        </div>
                    <?php endif; ?>
                </div>
                <h4 class="fw-bold mb-1"><?php echo sanitize($user['prefix'] . $user['firstname'] . ' ' . $user['lastname']); ?></h4>
                <p class="text-muted small mb-2"><i class="bi bi-person-badge me-1"></i><?php echo sanitize($user['username']); ?></p>
                <div>
                    <span class="badge bg-primary px-3 py-2 rounded-pill"><?php echo sanitize($user['role_name'] ?? 'ผู้ใช้ทั่วไป'); ?></span>
                </div>
                <?php if (!empty($user['department_name'])): ?>
                    <p class="text-muted small mt-2 mb-0"><i class="bi bi-building me-1"></i><?php echo sanitize($user['department_name']); ?></p>
                <?php endif; ?>
            </div>
        </div>

        <div class="col-md-8">
            <?php if (!empty($error)): ?>
                <div class="alert alert-danger mb-4"><?php echo $error; ?></div>
            <?php endif; ?>
            <?php if (!empty($success)): ?>
                <div class="alert alert-success mb-4"><?php echo $success; ?></div>
            <?php endif; ?>

            <!-- Edit Profile Card -->
            <div class="card border-0 shadow-sm glass-card p-4 mb-4">
                <h5 class="fw-bold mb-3"><i class="bi bi-pencil-square text-primary me-2"></i>แก้ไขข้อมูลส่วนตัว</h5>
                <form method="POST" enctype="multipart/form-data">
                    <input type="hidden" name="csrf_token" value="<?php echo get_csrf_token(); ?>">
                    
                    <div class="row">
                        <div class="col-md-3 mb-3">
                            <label class="form-label">คำนำหน้า</label>
                            <input type="text" name="prefix" class="form-control" value="<?php echo sanitize($user['prefix']); ?>" placeholder="เช่น นาย / นางสาว">
                        </div>
                        <div class="col-md-4 mb-3">
                            <label class="form-label">ชื่อ *</label>
                            <input type="text" name="firstname" class="form-control" value="<?php echo sanitize($user['firstname']); ?>" required>
                        </div>
                        <div class="col-md-5 mb-3">
                            <label class="form-label">นามสกุล *</label>
                            <input type="text" name="lastname" class="form-control" value="<?php echo sanitize($user['lastname']); ?>" required>
                        </div>
                    </div>

                    <div class="row">
                        <div class="col-md-6 mb-3">
                            <label class="form-label">เบอร์โทรศัพท์</label>
                            <input type="tel" name="phone" class="form-control" value="<?php echo sanitize($user['phone']); ?>" placeholder="08xxxxxxxx">
                        </div>
                        <div class="col-md-6 mb-3">
                            <label class="form-label">อีเมล</label>
                            <input type="email" name="email" class="form-control" value="<?php echo sanitize($user['email']); ?>" placeholder="example@email.com">
                        </div>
                    </div>

                    <div class="mb-3">
                        <label class="form-label fw-bold"><i class="bi bi-geo-alt me-1"></i>ที่อยู่สำหรับการจัดส่ง</label>
                        <div class="row g-2 mb-2">
                            <div class="col-md-6">
                                <label class="form-label small text-muted mb-1">ภาค</label>
                                <select id="profile_region" class="form-select form-select-sm">
                                    <option value="">-- เลือกภาค --</option>
                                </select>
                            </div>
                            <div class="col-md-6">
                                <label class="form-label small text-muted mb-1">จังหวัด</label>
                                <select id="profile_province" class="form-select form-select-sm" disabled>
                                    <option value="">-- เลือกจังหวัด --</option>
                                </select>
                            </div>
                            <div class="col-md-6">
                                <label class="form-label small text-muted mb-1">อำเภอ / เขต</label>
                                <select id="profile_district" class="form-select form-select-sm" disabled>
                                    <option value="">-- เลือกอำเภอ/เขต --</option>
                                </select>
                            </div>
                            <div class="col-md-6">
                                <label class="form-label small text-muted mb-1">ตำบล / แขวง</label>
                                <select id="profile_subdistrict" class="form-select form-select-sm" disabled>
                                    <option value="">-- เลือกตำบล/แขวง --</option>
                                </select>
                            </div>
                            <div class="col-md-4">
                                <label class="form-label small text-muted mb-1">รหัสไปรษณีย์</label>
                                <input type="text" id="profile_zipcode" class="form-control form-control-sm" placeholder="รหัสไปรษณีย์" readonly>
                            </div>
                            <div class="col-md-8">
                                <label class="form-label small text-muted mb-1">บ้านเลขที่ / หมู่ / ซอย / ถนน</label>
                                <input type="text" id="profile_houseno" class="form-control form-control-sm" placeholder="เช่น 123/45 ม.2 ถ.สุขุมวิท">
                            </div>
                        </div>
                        <textarea name="address" id="profile_address" class="form-control d-none"><?php echo sanitize($user['address'] ?? ''); ?></textarea>
                        <?php if (!empty($user['address'])): ?>
                            <div class="p-2 rounded bg-light border small text-muted mt-1">
                                <strong>ที่อยู่ปัจจุบัน:</strong> <?php echo sanitize($user['address']); ?>
                            </div>
                        <?php endif; ?>
                    </div>

                    <div class="mb-3">
                        <label class="form-label">เปลี่ยนรูปโปรไฟล์ (รองรับ JPG, PNG, WEBP)</label>
                        <input type="file" name="avatar" class="form-control" accept="image/jpeg,image/png,image/webp">
                    </div>

                    <button type="submit" name="update_profile" class="btn btn-primary px-4">
                        <i class="bi bi-check-circle me-1"></i> บันทึกข้อมูล
                    </button>
                </form>
            </div>

            <!-- Change Password Card -->
            <div class="card border-0 shadow-sm glass-card p-4">
                <h5 class="fw-bold mb-3"><i class="bi bi-key-fill text-warning me-2"></i>เปลี่ยนรหัสผ่าน</h5>
                <form method="POST">
                    <input type="hidden" name="csrf_token" value="<?php echo get_csrf_token(); ?>">

                    <div class="mb-3">
                        <label class="form-label">รหัสผ่านปัจจุบัน *</label>
                        <input type="password" name="old_password" class="form-control" required>
                    </div>

                    <div class="row">
                        <div class="col-md-6 mb-3">
                            <label class="form-label">รหัสผ่านใหม่ *</label>
                            <input type="password" name="new_password" class="form-control" required minlength="6" placeholder="อย่างน้อย 6 ตัวอักษร">
                        </div>
                        <div class="col-md-6 mb-3">
                            <label class="form-label">ยืนยันรหัสผ่านใหม่ *</label>
                            <input type="password" name="confirm_password" class="form-control" required minlength="6">
                        </div>
                    </div>

                    <button type="submit" name="change_password" class="btn btn-warning px-4">
                        <i class="bi bi-shield-check me-1"></i> อัปเดตรหัสผ่าน
                    </button>
                </form>
            </div>
        </div>
    </div>
</div>

<script src="<?php echo base_url('assets/js/thai_address.js'); ?>"></script>
<script>
document.addEventListener('DOMContentLoaded', function() {
    initThaiAddressSelector({
        region: '#profile_region',
        province: '#profile_province',
        district: '#profile_district',
        subdistrict: '#profile_subdistrict',
        zipcode: '#profile_zipcode',
        houseNo: '#profile_houseno',
        output: '#profile_address'
    });
});
</script>

<?php require_once __DIR__ . '/../includes/footer.php'; ?>