<?php
// Einmaliges Skript: alle Schüler*innen der Klasse von lernapps@oead.at ausser
// 'susi1' bekommen eine frische 4-Ziffern-PIN. Klartext + bcrypt werden gesetzt.
// Aufruf auf Production via php-CLI im webstack-php-Container.

$pdo = new PDO('mysql:host=mysql;dbname=geograsim;charset=utf8mb4', 'root', 'ServerMySQL2026!', [
    PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
]);

$teacher = $pdo->query("SELECT id FROM teachers WHERE email='lernapps@oead.at'")->fetch();
if (!$teacher) { echo "Lehrer nicht gefunden\n"; exit(1); }
$tid = $teacher['id'];

$classes = $pdo->prepare("SELECT id, name FROM classes WHERE teacher_id = ?");
$classes->execute([$tid]);
$rows = $classes->fetchAll();
echo "Lehrer-ID $tid hat " . count($rows) . " Klasse(n):\n";
foreach ($rows as $r) echo "  - {$r['id']} {$r['name']}\n";

if (count($rows) === 0) { echo "Keine Klasse, abbruch\n"; exit(1); }

// Alle Klassen des Lehrers durchgehen — Susi1 (case-insensitive) bleibt unangetastet
$classIds = array_column($rows, 'id');
$placeholders = implode(',', array_fill(0, count($classIds), '?'));
$students = $pdo->prepare(
  "SELECT id, username, display_name, class_id FROM students
   WHERE class_id IN ($placeholders) AND deleted_at IS NULL
     AND LOWER(username) != 'susi1'
   ORDER BY class_id, username"
);
$students->execute($classIds);
$students = $students->fetchAll();

echo "\nSetze PINs für " . count($students) . " Schüler*innen (Susi1 ausgenommen):\n";
echo "username,display_name,pin\n";

$update = $pdo->prepare("UPDATE students SET password = ?, password_plaintext = ? WHERE id = ?");
foreach ($students as $s) {
    $pin = str_pad((string)random_int(1000, 9999), 4, '0', STR_PAD_LEFT);
    $hash = password_hash($pin, PASSWORD_DEFAULT);
    $update->execute([$hash, $pin, $s['id']]);
    $name = $s['display_name'] ?: $s['username'];
    echo "{$s['username']},{$name},{$pin}\n";
}

echo "\nFertig. PINs sind in der Datenbank gespeichert (auch als Klartext für Lehrer-Anzeige).\n";