<?php
if (session_status() === PHP_SESSION_NONE) {
    session_start();
}

// Global Promo Coupon Handler from Navbar
if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['apply_nav_coupon'])) {
    $coupon_code = strtoupper(trim($_POST['coupon_code'] ?? ''));
    if ($coupon_code === 'CYBER10') {
        $_SESSION['coupon'] = [
            'code' => 'CYBER10',
            'discount_percent' => 10
        ];
        $_SESSION['coupon_msg'] = 'ใช้งานโค้ดส่วนลด CYBER10 สำเร็จ! รับส่วนลด 10%';
    } else if (!empty($coupon_code)) {
        $_SESSION['coupon_err'] = 'โค้ดส่วนลด "' . htmlspecialchars($coupon_code) . '" ไม่ถูกต้อง';
    }
    $redirect_url = $_SERVER['REQUEST_URI'];
    header("Location: " . $redirect_url);
    exit();
}

if (isset($_GET['action']) && $_GET['action'] === 'remove_nav_coupon') {
    unset($_SESSION['coupon']);
    $redirect_url = strtok($_SERVER['REQUEST_URI'], '?');
    header("Location: " . $redirect_url);
    exit();
}

require_once __DIR__ . '/../config/db.php';
require_once __DIR__ . '/jwt_helper.php';

/**
 * Returns current authenticated user payload, or false if not authenticated
 */
function get_current_user_data() {
    $token = null;
    
    // Check cookie or session
    if (isset($_COOKIE['auth_token'])) {
        $token = $_COOKIE['auth_token'];
    } elseif (isset($_SESSION['auth_token'])) {
        $token = $_SESSION['auth_token'];
    }
    
    if (!$token) {
        return false;
    }
    
    $decoded = JWTHelper::decode($token, JWT_SECRET);
    if (!$decoded) {
        return false;
    }
    
    return $decoded;
}

/**
 * Rejects access and redirects to login if the user does not have required permissions
 */
function require_login($allowed_roles = []) {
    $user = get_current_user_data();

    if (!$user) {
        header("Location: login.php");
        exit();
    }
    
    // Verify status in DB (in case of rejection or status updates)
    global $pdo;
    try {
        $stmt = $pdo->prepare("SELECT role, status FROM users WHERE id = ?");
        $stmt->execute([$user['id']]);
        $dbUser = $stmt->fetch();
        
        if (!$dbUser) {
            logout_user();
            header("Location: login.php?error=not_found");
            exit();
        }
        
        if ($dbUser['status'] !== 'approved') {
            logout_user();
            header("Location: login.php?error=pending");
            exit();
        }
        
        // Update session state with fresh DB roles if mismatch
        if ($dbUser['role'] !== $user['role']) {
            $user['role'] = $dbUser['role'];
            // Re-encode
            $newToken = JWTHelper::encode($user, JWT_SECRET);
            $_SESSION['auth_token'] = $newToken;
            setcookie('auth_token', $newToken, time() + 86400, '/', '', false, true);
        }
    } catch (PDOException $e) {
        // Fallback to token values if DB check fails
    }
    
    if (!empty($allowed_roles) && !in_array($user['role'], $allowed_roles)) {
        header("Location: login.php?error=unauthorized");
        exit();
    }
    
    return $user;
}

/**
 * Log out user by clearing cookies and session data
 */
function logout_user() {
    if (session_status() === PHP_SESSION_NONE) {
        session_start();
    }
    unset($_SESSION['auth_token']);
    setcookie('auth_token', '', time() - 3600, '/');
    session_destroy();
}

/**
 * Returns member discount percentage (10% for logged in customer members)
 */
function get_member_discount_percent() {
    $user = get_current_user_data();
    if ($user && in_array($user['role'], ['customer', 'user', 'admin', 'super_admin'])) {
        return 10; // 10% discount for registered members
    }
    return 0;
}