<?php
/**
 * Authentication and User Management Helper Functions
 */

if (session_status() === PHP_SESSION_NONE) {
    session_start();
}

/**
 * Check if a user is logged in.
 */
function is_logged_in() {
    return isset($_SESSION['user']) && !empty($_SESSION['user']['id']);
}

/**
 * Get current logged in user details.
 */
function current_user() {
    return $_SESSION['user'] ?? null;
}

/**
 * Check if logged in user is owner.
 */
function is_owner() {
    $user = current_user();
    return $user && ($user['role'] === 'owner');
}

/**
 * Check if logged in user is admin (or owner).
 */
function is_admin() {
    $user = current_user();
    return $user && ($user['role'] === 'admin' || $user['role'] === 'owner');
}

/**
 * Require login to access a page.
 */
function require_login() {
    if (!is_logged_in()) {
        header("Location: index.php?page=login");
        exit;
    }
}

/**
 * Require admin role to access a page.
 */
function require_admin() {
    require_login();
    if (!is_admin()) {
        header("Location: index.php?page=home");
        exit;
    }
}

/**
 * Authenticate user with username and password.
 */
function login_user($username, $password) {
    global $conn;
    
    $username = trim($username);
    if (empty($username) || empty($password)) {
        return ['success' => false, 'message' => 'Inserisci sia username che password.'];
    }

    $stmt = $conn->prepare("SELECT id, username, password, role, theme_pri, theme_sec, theme_thi, language, default_blocknote FROM users WHERE username = ? LIMIT 1");
    $stmt->bind_param("s", $username);
    $stmt->execute();
    $result = $stmt->get_result();

    if ($row = $result->fetch_assoc()) {
        if (password_verify($password, $row['password'])) {
            $_SESSION['user'] = [
                'id' => $row['id'],
                'username' => $row['username'],
                'role' => $row['role'],
                'theme_pri' => $row['theme_pri'] ?? 98,
                'theme_sec' => $row['theme_sec'] ?? 207,
                'theme_thi' => $row['theme_thi'] ?? 280,
                'language' => $row['language'] ?? 'it',
                'default_blocknote' => $row['default_blocknote'] ?? ''
            ];
            $stmt->close();
            return ['success' => true];
        }
    }
    $stmt->close();
    return ['success' => false, 'message' => 'Username o password errati.'];
}

/**
 * Logout current user.
 */
function logout_user() {
    $_SESSION = array();
    if (ini_get("session.use_cookies")) {
        $params = session_get_cookie_params();
        setcookie(session_name(), '', time() - 42000,
            $params["path"], $params["domain"],
            $params["secure"], $params["httponly"]
        );
    }
    session_destroy();
}

/**
 * Update user password.
 */
function update_user_password($user_id, $new_password) {
    global $conn;
    if (strlen($new_password) < 4) {
        return ['success' => false, 'message' => 'La password deve contenere almeno 4 caratteri.'];
    }
    $hash = password_hash($new_password, PASSWORD_DEFAULT);
    $stmt = $conn->prepare("UPDATE users SET password = ? WHERE id = ?");
    $stmt->bind_param("si", $hash, $user_id);
    $res = $stmt->execute();
    $stmt->close();

    return $res ? ['success' => true, 'message' => 'Password aggiornata con successo!'] : ['success' => false, 'message' => 'Errore durante il salvataggio della password.'];
}

/**
 * Update user language preference.
 */
function update_user_language($user_id, $lang) {
    global $conn;
    if (!in_array($lang, ['it', 'en', 'es', 'fr'])) {
        $lang = 'it';
    }

    $stmt = $conn->prepare("UPDATE users SET language = ? WHERE id = ?");
    $stmt->bind_param("si", $lang, $user_id);
    $res = $stmt->execute();
    $stmt->close();

    if ($res) {
        if (isset($_SESSION['user']) && $_SESSION['user']['id'] == $user_id) {
            $_SESSION['user']['language'] = $lang;
        }
        return ['success' => true, 'message' => 'Lingua aggiornata con successo!'];
    }
    return ['success' => false, 'message' => 'Errore durante l\'aggiornamento della lingua.'];
}

/**
 * Update user default landing blocknote preference.
 */
function update_user_default_blocknote($user_id, $bn_id) {
    global $conn;
    $bn_id = trim($bn_id);

    $stmt = $conn->prepare("UPDATE users SET default_blocknote = ? WHERE id = ?");
    $stmt->bind_param("si", $bn_id, $user_id);
    $res = $stmt->execute();
    $stmt->close();

    if ($res) {
        if (isset($_SESSION['user']) && $_SESSION['user']['id'] == $user_id) {
            $_SESSION['user']['default_blocknote'] = $bn_id;
        }
        return ['success' => true, 'message' => 'Pagina di avvio aggiornata con successo!'];
    }
    return ['success' => false, 'message' => 'Errore durante l\'aggiornamento della pagina di avvio.'];
}

/**
 * Update user interface theme colors (HSL).
 */
function update_user_theme($user_id, $pri, $sec, $thi) {
    global $conn;
    $pri = max(0, min(360, (int)$pri));
    $sec = max(0, min(360, (int)$sec));
    $thi = max(0, min(360, (int)$thi));

    $stmt = $conn->prepare("UPDATE users SET theme_pri = ?, theme_sec = ?, theme_thi = ? WHERE id = ?");
    $stmt->bind_param("iiii", $pri, $sec, $thi, $user_id);
    $res = $stmt->execute();
    $stmt->close();

    if ($res) {
        if (isset($_SESSION['user']) && $_SESSION['user']['id'] == $user_id) {
            $_SESSION['user']['theme_pri'] = $pri;
            $_SESSION['user']['theme_sec'] = $sec;
            $_SESSION['user']['theme_thi'] = $thi;
        }
        return ['success' => true, 'message' => 'Colori dell\'interfaccia aggiornati!'];
    }
    return ['success' => false, 'message' => 'Errore durante l\'aggiornamento dei colori.'];
}

/**
 * Admin: Get list of all registered users.
 */
function get_all_users() {
    global $conn;
    $result = $conn->query("SELECT id, username, role, created_at FROM users ORDER BY id ASC");
    $users = [];
    while ($row = $result->fetch_assoc()) {
        $users[] = $row;
    }
    return $users;
}

/**
 * Admin: Register a new user.
 */
function admin_create_user($username, $password, $role = 'user') {
    global $conn;
    $username = trim($username);
    if (empty($username) || empty($password)) {
        return ['success' => false, 'message' => 'Username e password sono obbligatori.'];
    }
    if (!in_array($role, ['user', 'admin', 'owner'])) {
        $role = 'user';
    }

    if ($role === 'owner') {
        $check_owner = $conn->query("SELECT id FROM users WHERE role = 'owner'");
        if ($check_owner->num_rows > 0) {
            return ['success' => false, 'message' => 'Può esistere un solo account Owner nel sistema!'];
        }
    }

    // Check if exists
    $stmt = $conn->prepare("SELECT id FROM users WHERE username = ? LIMIT 1");
    $stmt->bind_param("s", $username);
    $stmt->execute();
    if ($stmt->get_result()->num_rows > 0) {
        $stmt->close();
        return ['success' => false, 'message' => 'Un utente con questo username esiste già.'];
    }
    $stmt->close();

    $hash = password_hash($password, PASSWORD_DEFAULT);
    $stmt = $conn->prepare("INSERT INTO users (username, password, role) VALUES (?, ?, ?)");
    $stmt->bind_param("sss", $username, $hash, $role);
    $res = $stmt->execute();
    $stmt->close();

    return $res ? ['success' => true, 'message' => 'Utente creato con successo!'] : ['success' => false, 'message' => 'Impossibile creare l\'utente.'];
}

/**
 * Admin: Delete a user by ID.
 */
function admin_delete_user($user_id) {
    global $conn;
    $user_id = (int)$user_id;
    
    // Prevent self-deletion
    if (current_user() && current_user()['id'] == $user_id) {
        return ['success' => false, 'message' => 'Non puoi eliminare il tuo stesso account!'];
    }

    // Check target user role - Owner can NEVER be deleted
    $stmt = $conn->prepare("SELECT role FROM users WHERE id = ? LIMIT 1");
    $stmt->bind_param("i", $user_id);
    $stmt->execute();
    $target_user = $stmt->get_result()->fetch_assoc();
    $stmt->close();

    if ($target_user && $target_user['role'] === 'owner') {
        return ['success' => false, 'message' => 'L\'account Owner non può essere eliminato da nessuno!'];
    }

    $stmt = $conn->prepare("DELETE FROM users WHERE id = ?");
    $stmt->bind_param("i", $user_id);
    $res = $stmt->execute();
    $stmt->close();

    return $res ? ['success' => true, 'message' => 'Utente eliminato.'] : ['success' => false, 'message' => 'Errore nell\'eliminazione dell\'utente.'];
}

/**
 * Admin: Update user role.
 */
function admin_update_user_role($user_id, $role) {
    global $conn;
    $user_id = (int)$user_id;
    if (!in_array($role, ['admin', 'user', 'owner'])) return ['success' => false, 'message' => 'Ruolo non valido.'];

    // Check target user role - Owner role cannot be changed
    $stmt = $conn->prepare("SELECT role FROM users WHERE id = ? LIMIT 1");
    $stmt->bind_param("i", $user_id);
    $stmt->execute();
    $target_user = $stmt->get_result()->fetch_assoc();
    $stmt->close();

    if ($target_user && $target_user['role'] === 'owner') {
        return ['success' => false, 'message' => 'Il ruolo dell\'account Owner non può essere modificato!'];
    }

    if ($role === 'owner') {
        $check_owner = $conn->query("SELECT id FROM users WHERE role = 'owner'");
        if ($check_owner->num_rows > 0) {
            return ['success' => false, 'message' => 'Può esistere un solo account Owner nel sistema!'];
        }
    }

    $stmt = $conn->prepare("UPDATE users SET role = ? WHERE id = ?");
    $stmt->bind_param("si", $role, $user_id);
    $res = $stmt->execute();
    $stmt->close();

    return $res ? ['success' => true, 'message' => 'Ruolo aggiornato.'] : ['success' => false, 'message' => 'Impossibile aggiornare il ruolo.'];
}