<?php
// POST /api/auth/refresh.php — Silent token rotation
require_once __DIR__ . '/../init.php';

if ($_SERVER['REQUEST_METHOD'] !== 'POST') Response::error('Method not allowed.', 405);

$refreshToken = $_COOKIE['refreshToken'] ?? '';
if (!$refreshToken) Response::unauthorized('No refresh token. Please login again.', 'NO_REFRESH');

$db = DB::conn();

// ─── Validate refresh token ───────────────────────────────
try {
    $payload = JWT::decode($refreshToken, JWT_REFRESH_SECRET);
} catch (RuntimeException $e) {
    clearRefreshCookie();
    $stmt = $db->prepare('DELETE FROM user_sessions WHERE refresh_token = ?');
    $stmt->execute([$refreshToken]);
    Response::unauthorized('Refresh token expired or invalid. Please login again.', 'REFRESH_INVALID');
}

// ─── Check session still valid in DB ─────────────────────
$stmt = $db->prepare(
    'SELECT * FROM user_sessions WHERE refresh_token = ? AND expires_at > NOW() LIMIT 1'
);
$stmt->execute([$refreshToken]);
$session = $stmt->fetch();

if (!$session) {
    clearRefreshCookie();
    Response::unauthorized('Session expired. Please login again.', 'SESSION_EXPIRED');
}

// ─── Fetch user ───────────────────────────────────────────
$stmt = $db->prepare('SELECT id, username, email, role, avatar_url FROM users WHERE id = ? AND is_active = 1');
$stmt->execute([$payload['id']]);
$user = $stmt->fetch();

if (!$user) {
    clearRefreshCookie();
    Response::unauthorized('User not found.', 'USER_NOT_FOUND');
}

// ─── Issue new access token ───────────────────────────────
$newAccessToken = buildAccessToken($user);

Response::success('Token refreshed.', [
    'accessToken' => $newAccessToken,
    'user' => [
        'id'         => (int)$user['id'],
        'username'   => $user['username'],
        'email'      => $user['email'],
        'role'       => $user['role'],
        'avatar_url' => $user['avatar_url'],
    ],
]);