<?php
/**
 * API: Authentifizierung (Lehrer + Schueler)
 * POST /api/auth {action: "register"|"login"|"logout"|"student_login"|"reset_request"|"reset_confirm"}
 */

if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    Response::error('Nur POST erlaubt', 405);
}

$body = json_decode(file_get_contents('php://input'), true);
$action = $body['action'] ?? '';
$db = Database::get();

// === LEHRER-REGISTRIERUNG ===
if ($action === 'register') {
    $email = trim($body['email'] ?? '');
    $password = $body['password'] ?? '';
    $displayName = mb_substr(trim($body['displayName'] ?? ''), 0, 128);
    $schoolName = mb_substr(trim($body['schoolName'] ?? ''), 0, 255);

    if (!$email || !filter_var($email, FILTER_VALIDATE_EMAIL)) Response::error('Gültige E-Mail-Adresse erforderlich');
    if (strlen($password) < 8) Response::error('Passwort muss mindestens 8 Zeichen lang sein');
    if (!$displayName) Response::error('Name erforderlich');

    // Pruefen ob E-Mail schon existiert
    $existing = $db->fetchOne('SELECT id FROM teachers WHERE email = ?', [$email]);
    if ($existing) Response::error('Diese E-Mail-Adresse ist bereits registriert');

    // Regel (ab 2026-08): Der Benutzername einer Lehrperson IST ihre E-Mail-Adresse.
    // Bestehende, abweichende Benutzernamen bleiben gültig (Login akzeptiert E-Mail ODER Benutzername).
    $username = strtolower($email);
    $hash = password_hash($password, PASSWORD_DEFAULT);

    $db->execute(
        'INSERT INTO teachers (username, email, password, display_name, school_name) VALUES (?, ?, ?, ?, ?)',
        [$username, $email, $hash, $displayName, $schoolName]
    );

    $teacherId = (int)$db->lastInsertId();
    Session::start();
    Session::loginTeacher($teacherId);

    // "Meine Klasse" automatisch anlegen
    $chars = 'ABCDEFGHJKLMNPQRSTUVWXYZ23456789';
    $joinCode = '';
    do {
        $joinCode = '';
        for ($i = 0; $i < 6; $i++) $joinCode .= $chars[random_int(0, strlen($chars) - 1)];
        $exists = $db->fetchOne('SELECT id FROM classes WHERE join_code = ?', [$joinCode]);
    } while ($exists);

    $db->execute(
        'INSERT INTO classes (teacher_id, name, school_year, join_code) VALUES (?, ?, ?, ?)',
        [$teacherId, 'Meine Klasse', date('Y') . '/' . (date('y') + 1), $joinCode]
    );

    // Willkommens-Mail senden (nicht-blockierend)
    if (class_exists('Mailer')) {
        Mailer::sendWelcomeTeacher($email, $displayName);
    }

    Response::ok([
        'teacherId' => $teacherId,
        'displayName' => $displayName,
    ]);
}

// === LEHRER-LOGIN ===
if ($action === 'login') {
    $email = trim($body['email'] ?? '');
    $password = $body['password'] ?? '';

    if (!$email || !$password) Response::error('E-Mail und Passwort erforderlich');

    $teacher = $db->fetchOne(
        'SELECT id, password, display_name FROM teachers WHERE email = ? OR username = ?',
        [$email, $email]
    );

    if (!$teacher || !password_verify($password, $teacher['password'])) {
        Response::error('E-Mail oder Passwort falsch');
    }

    Session::start();
    Session::loginTeacher((int)$teacher['id']);

    $db->execute(
        "INSERT INTO activity_log (user_type, user_id, action) VALUES ('teacher', ?, 'login')",
        [$teacher['id']]
    );

    Response::ok([
        'teacherId' => (int)$teacher['id'],
        'displayName' => $teacher['display_name'],
    ]);
}

// === SCHÜLER*IN SELBST-REGISTRIERUNG (mit Klassencode) ===
if ($action === 'student_register') {
    $classCode = strtoupper(trim($body['classCode'] ?? ''));
    $username = trim($body['username'] ?? '');
    $password = $body['password'] ?? '';

    if (!$classCode || !$username || !$password) Response::error('Klassencode, Benutzername und Passwort erforderlich');
    if (strlen($password) < 4) Response::error('Passwort muss mindestens 4 Zeichen haben');

    $class = $db->fetchOne('SELECT id, name FROM classes WHERE join_code = ?', [$classCode]);
    if (!$class) Response::error('Klassencode ungültig');

    // Prüfen ob Username schon existiert
    $existing = $db->fetchOne('SELECT id FROM students WHERE class_id = ? AND username = ?', [$class['id'], $username]);
    if ($existing) Response::error('Benutzername in dieser Klasse bereits vergeben');

    $hash = password_hash($password, PASSWORD_DEFAULT);
    $db->execute(
        'INSERT INTO students (class_id, username, password, display_name, is_anonymous) VALUES (?, ?, ?, ?, 0)',
        [$class['id'], $username, $hash, $username]
    );

    // Direkt einloggen
    $sessionId = Session::createStudent((int)$class['id'], $username);

    Response::ok([
        'sessionId' => $sessionId,
        'displayName' => $username,
        'className' => $class['name'],
    ]);
}

// === SCHÜLER*IN LOGIN OHNE KLASSENCODE (sucht über alle Klassen) ===
if ($action === 'student_login_by_username') {
    $username = trim($body['username'] ?? '');
    $password = $body['password'] ?? '';

    if (!$username || !$password) Response::error('Benutzername und Passwort erforderlich');

    $student = $db->fetchOne(
        'SELECT s.id, s.password, s.display_name, s.class_id, c.name as class_name, c.join_code
         FROM students s JOIN classes c ON c.id = s.class_id
         WHERE s.username = ? AND s.deleted_at IS NULL
         ORDER BY s.last_login DESC LIMIT 1',
        [$username]
    );

    if (!$student || !password_verify($password, $student['password'])) {
        Response::error('Benutzername oder Passwort falsch');
    }

    $sessionId = Session::createStudent((int)$student['class_id'], $student['display_name'] ?: $username);
    $db->execute('UPDATE students SET last_login = NOW() WHERE id = ?', [$student['id']]);

    Response::ok([
        'sessionId' => $sessionId,
        'studentId' => (int)$student['id'],
        'displayName' => $student['display_name'] ?: $username,
        'className' => $student['class_name'] ?? '',
    ]);
}

// === LOGOUT ===
if ($action === 'logout') {
    Session::logout();
    Response::ok();
}

// === SCHUELER-LOGIN ===
if ($action === 'student_login') {
    $classCode = strtoupper(trim($body['classCode'] ?? ''));
    $username = trim($body['username'] ?? '');
    $password = $body['password'] ?? '';

    if (!$classCode || !$username || !$password) Response::error('Klassencode, Benutzername und Passwort erforderlich');

    $class = $db->fetchOne('SELECT id, name FROM classes WHERE join_code = ?', [$classCode]);
    if (!$class) Response::error('Klasse nicht gefunden');

    $student = $db->fetchOne(
        'SELECT id, password, display_name FROM students WHERE class_id = ? AND username = ?',
        [$class['id'], $username]
    );

    if (!$student || !password_verify($password, $student['password'])) {
        Response::error('Benutzername oder Passwort falsch');
    }

    // Schueler-Session erstellen
    $sessionId = Session::createStudent((int)$class['id'], $student['display_name'] ?: $username);

    $db->execute('UPDATE students SET last_login = NOW() WHERE id = ?', [$student['id']]);
    $db->execute(
        "INSERT INTO activity_log (user_type, user_id, action) VALUES ('student', ?, 'login')",
        [$student['id']]
    );

    Response::ok([
        'sessionId' => $sessionId,
        'studentId' => (int)$student['id'],
        'displayName' => $student['display_name'] ?: $username,
        'className' => $class['name'] ?? '',
    ]);
}

// === PASSWORT-RESET ANFORDERN ===
if ($action === 'reset_request') {
    $email = trim($body['email'] ?? '');
    if (!$email) Response::error('E-Mail-Adresse erforderlich');

    $teacher = $db->fetchOne('SELECT id, display_name FROM teachers WHERE email = ?', [$email]);
    if (!$teacher) {
        // Kein Fehler zurückgeben (Datenschutz)
        Response::ok(['message' => 'Falls ein Konto existiert, wurde eine E-Mail gesendet.']);
    }

    $token = bin2hex(random_bytes(32));
    $db->execute('UPDATE teachers SET reset_token = ?, reset_expires = DATE_ADD(NOW(), INTERVAL 1 HOUR) WHERE id = ?', [$token, $teacher['id']]);

    if (class_exists('Mailer')) {
        Mailer::sendPasswordReset($email, $teacher['display_name'] ?: 'Lehrkraft', $token);
    }

    Response::ok(['message' => 'Falls ein Konto existiert, wurde eine E-Mail gesendet.']);
}

// === PASSWORT-RESET BESTÄTIGEN ===
if ($action === 'reset_confirm') {
    $token = trim($body['token'] ?? '');
    $newPassword = $body['newPassword'] ?? '';

    if (!$token || !$newPassword) Response::error('Token und neues Passwort erforderlich');
    if (strlen($newPassword) < 8) Response::error('Passwort muss mindestens 8 Zeichen haben');

    $teacher = $db->fetchOne('SELECT id FROM teachers WHERE reset_token = ? AND reset_expires > NOW()', [$token]);
    if (!$teacher) Response::error('Link ist ungültig oder abgelaufen');

    $db->execute('UPDATE teachers SET password = ?, reset_token = NULL, reset_expires = NULL WHERE id = ?',
        [password_hash($newPassword, PASSWORD_DEFAULT), $teacher['id']]);

    Response::ok(['message' => 'Passwort wurde geändert.']);
}

// === STATUS ===
if ($action === 'status') {
    Session::start();
    $teacherId = Session::teacherId();
    $studentId = Session::studentId();

    if ($teacherId) {
        $teacher = $db->fetchOne('SELECT id, display_name, email, school_name FROM teachers WHERE id = ?', [$teacherId]);
        Response::ok(['role' => 'teacher', 'user' => $teacher]);
    }
    if ($studentId) {
        $session = $db->fetchOne(
            'SELECT s.display_name, s.class_id, c.name as class_name FROM student_sessions s LEFT JOIN classes c ON c.id = s.class_id WHERE s.id = ?',
            [$studentId]
        );
        Response::ok(['role' => 'student', 'session' => $session]);
    }
    Response::ok(['role' => 'guest']);
}

// === KONTAKTFORMULAR ===
if ($action === 'contact') {
    $name = mb_substr(trim($body['name'] ?? ''), 0, 128);
    $email = trim($body['email'] ?? '');
    $subject = mb_substr(trim($body['subject'] ?? ''), 0, 128);
    $message = mb_substr(trim($body['message'] ?? ''), 0, 5000);

    if (!$name || !$email || !$message) Response::error('Alle Felder erforderlich');
    if (!filter_var($email, FILTER_VALIDATE_EMAIL)) Response::error('Ungültige E-Mail-Adresse');

    if (class_exists('Mailer')) {
        $html = '<p><strong>Kontaktformular GeoGraSim</strong></p>'
            . '<p><strong>Von:</strong> ' . htmlspecialchars($name) . ' (' . htmlspecialchars($email) . ')</p>'
            . '<p><strong>Betreff:</strong> ' . htmlspecialchars($subject) . '</p>'
            . '<p><strong>Nachricht:</strong></p>'
            . '<p>' . nl2br(htmlspecialchars($message)) . '</p>';
        Mailer::send('support@geograsim.at', 'Kontakt: ' . $subject . ' — ' . $name, $html);
    }

    Response::ok(['message' => 'Nachricht gesendet.']);
}

Response::error('Unbekannte Aktion');