<?php
// includes/helper.php - Security and Formatting Helper Functions

// Start session securely if not already started
function start_secure_session() {
    if (session_status() == PHP_SESSION_NONE) {
        // Enforce cookie security policies (PHP 7.3+ standard)
        ini_set('session.cookie_httponly', 1);
        ini_set('session.use_only_cookies', 1);
        ini_set('session.cookie_samesite', 'Lax');
        
        // Secure flag should ideally be enabled on HTTPS environments
        if (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] === 'on') {
            ini_set('session.cookie_secure', 1);
        }
        
        session_start();
    }
}

// XSS (Cross-Site Scripting) protection helper
function escape($html) {
    return htmlspecialchars($html, ENT_QUOTES, 'UTF-8');
}

// CSRF (Cross-Site Request Forgery) Token Generation
function generate_csrf_token() {
    start_secure_session();
    if (empty($_SESSION['csrf_token'])) {
        $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
    }
    return $_SESSION['csrf_token'];
}

// CSRF Token Validation
function validate_csrf_token($token) {
    start_secure_session();
    if (isset($_SESSION['csrf_token']) && hash_equals($_SESSION['csrf_token'], $token)) {
        return true;
    }
    return false;
}

// Money Formatting Helper (Thai Baht)
function format_price($number) {
    return '฿' . number_format($number, 2);
}

// Helper to resolve product image URL safely
function get_product_image_url($imageUrl, $productName = '') {
    $src = trim((string)($imageUrl ?? ''));
    
    // Direct web URL
    if (strpos($src, 'http://') === 0 || strpos($src, 'https://') === 0) {
        return $src;
    }

    $fallbackByKeyword = function($name) {
        $n = mb_strtolower((string)$name, 'UTF-8');
        if (strpos($n, 'ยีนส์') !== false || strpos($n, 'jeans') !== false || strpos($n, 'washed') !== false || strpos($n, 'กางเกง') !== false) {
            return 'assets/products/washed_jeans.png';
        } else if (strpos($n, 'ฮู้ด') !== false || strpos($n, 'hoodie') !== false || strpos($n, 'กันหนาว') !== false) {
            return 'assets/products/heavy_hoodie.png';
        } else if (strpos($n, 'หมวก') !== false || strpos($n, 'cap') !== false || strpos($n, 'street') !== false) {
            return 'assets/products/street_cap.png';
        } else if (strpos($n, 'เป้') !== false || strpos($n, 'กระเป๋า') !== false || strpos($n, 'backpack') !== false || strpos($n, 'waterproof') !== false) {
            return 'assets/products/waterproof_backpack.png';
        } else if (strpos($n, 'รองเท้า') !== false || strpos($n, 'sneaker') !== false || strpos($n, 'คลาสสิก') !== false) {
            return 'assets/products/classic_sneakers.png';
        } else if (strpos($n, 'แว่น') !== false || strpos($n, 'sunglasses') !== false || strpos($n, 'retro') !== false) {
            return 'assets/products/retro_sunglasses.png';
        } else if (strpos($n, 'เสื้อ') !== false || strpos($n, 'tshirt') !== false || strpos($n, 'oversized') !== false) {
            return 'assets/products/oversized_tshirt.png';
        }
        return 'assets/products/oversized_tshirt.png';
    };

    // If empty or just directory prefix
    if (empty($src) || $src === 'รูป/products/' || $src === 'assets/products/' || $src === 'รูป/' || $src === 'assets/') {
        return $fallbackByKeyword($productName);
    }

    // Convert Thai path prefix 'รูป/' to 'assets/' for maximum web server compatibility
    if (strpos($src, 'รูป/products/') === 0) {
        return 'assets/products/' . substr($src, strlen('รูป/products/'));
    }
    if (strpos($src, 'รูป/banner/') === 0) {
        return 'assets/banner/' . substr($src, strlen('รูป/banner/'));
    }
    if (strpos($src, 'รูป/') === 0) {
        return 'assets/' . substr($src, strlen('รูป/'));
    }

    // If already starts with assets/
    if (strpos($src, 'assets/') === 0) {
        return $src;
    }

    // If only filename is provided
    return 'assets/products/' . basename($src);
}