<?php

//**********************************************************************************************************//
// Method: GET
// Endpoint: admins
// Params: none
// Description: Returns all membership plans in system
function get_v1_auth_admins( $args, $body, $uid, $is_admin, $db ) {
    validate_token( $uid );

    $sql = "SELECT * FROM plans";
    $plans = qSet( $db, $sql );

    if (!$is_admin) {
        response(200, ['success' => false, 'error' => 'Only admins can access this endpoint']);
    } else {
        $sql = "SELECT user_id, fname, lname, email FROM users WHERE admin=1 ORDER BY lname ASC";
        $admins = qSet( $db, $sql );
        response(200, ['success' => true, 'admins' => $admins]);
    }
}

//**********************************************************************************************************//
// Method: POST
// Endpoint: user
// Params: email, password
function post_v1_auth_user( $args, $body, $uid, $is_admin, $db ) {
    $rules = [
        'lname' => 'req',
        'fname' => 'req',
        'email' => 'req,email',
        'password' => 'req',
    ];
    validate_body( $body, $rules );

    $ins = "INSERT INTO users (lname, fname, email, password_hash, active, created_at, updated_at) VALUES 
            ( '".$body['lname']."', '".$body['fname']."', '".$body['email']."', '".password_hash($body['password'], PASSWORD_BCRYPT)."', 1, ".time().", ".time()." )";
    if ($result = $db->query($ins)) {
        $user_id = qVal($db, "SELECT MAX(user_id) FROM users");
        response(200, ['success'=>true,'user_id'=>$user_id]);
    } else {
        response(400, ['success'=>false,'errors'=>[$db->error]]);
    }
}


//**********************************************************************************************************//
// Method: GET
// Endpoint: pwhash
// Params: pw
function get_v1_auth_pwhash( $args, $body, $uid, $is_admin, $db ) {
    echo password_hash($args[0], PASSWORD_BCRYPT);
}


//**********************************************************************************************************//
// Method: PUT
// Endpoint: user
// Params: oldpw, pw1, pw2
function put_v1_auth_setpw( $args, $body, $uid, $is_admin, $db ) {
    $rules = [
        'user_id' => 'req',
        'oldpw' => 'req',
        'pw1' => 'req',
        'pw2' => 'req',
    ];
    validate_body( $body, $rules );

    if ($body['pw1'] !== $body['pw2']) {
        response(200, ['success'=>false,'errors'=>['Passwords do not match.']]);
    }
    else {
        // check old password
        $user = qRow( $db, "SELECT * FROM users WHERE user_id='".$body['user_id']."'" );
        $valid_login = password_verify($body['oldpw'], $user['password_hash']);

        if ($valid_login) {
            // update password
            $db->query("UPDATE users SET password_hash='".password_hash($body['pw1'], PASSWORD_BCRYPT)."' WHERE user_id=".$body['user_id']);
            response(200, ['success'=>true]);
        } else {
            response(200, ['success'=>false,'errors'=>['Current password is incorrect.']]);
        }
    }
}


//**********************************************************************************************************//
// Method: POST
// Endpoint: token
// Params: email, password
function post_v1_auth_token( $args, $body, $uid, $is_admin, $db ) {
    $rules = [
        'email' => 'req,email',
        'password' => 'req',
    ];
    validate_body( $body, $rules );

    $sql = "SELECT * FROM users WHERE email='".$body['email']."'";
    $user = qRow( $db, $sql );

    $valid_login = !empty($user['user_id']);
    if ($valid_login) {
        $valid_login = password_verify($body['password'], $user['password_hash']);
    }

    if ($valid_login && $user['active']) {
        $token = new_token( $db, $user['user_id'] );
        $user['token'] = $token['token'];
        $user['token_expires'] = $token['expires'];
        $user['token_created'] = $token['created'];
        unset($user['password_hash']);
        response(200, ['success' => true, 'user' => $user]);

    } else if ($valid_login && !$user['active']) {
        response(401, ['success'=>false,'errors'=>['Account is deactivated.']]);

    } else {
        response(401, ['success'=>false,'errors'=>['Email / password combo is invalid.']]);
    }
}


//**********************************************************************************************************//
// Method: GET
// Endpoint: user
// Params: none
// Description: Returns user associated with an active token
function get_v1_auth_user( $args, $body, $uid, $is_admin, $db ) {
    validate_token( $uid );

    $sql = "SELECT * FROM users as u,
                          tokens as t 
            WHERE t.token='".$_SERVER['HTTP_AUTHORIZATION']."' AND t.user_id=u.user_id";
    $user = qRow( $db, $sql );

    $user['token_expires'] = $user['expires'];
    $user['token_created'] = $user['created'];
    unset($user['password_hash']);
    unset($user['token_id']);
    unset($user['expires']);
    unset($user['created']);

    response(200, ['success' => true, 'user' => $user]);
}


//**********************************************************************************************************//
// Method: GET
// Endpoint: plans
// Params: none
// Description: Returns all membership plans in system
function get_v1_auth_plans( $args, $body, $uid, $is_admin, $db ) {
    validate_token( $uid );

    $sql = "SELECT * FROM plans";
    $plans = qSet( $db, $sql );

    response(200, ['success' => true, 'plans' => $plans]);
}


//**********************************************************************************************************//
// Method: PUT
// Endpoint: plan
// Params: none
// Description: Updates a plan for a member group
function put_v1_auth_plan( $args, $body, $uid, $is_admin, $db ) {
    validate_token( $uid );

    // SET THE NEW PLAN ID FOR EACH GROUP MEMBER
    $db->query("UPDATE groups SET plan_id=".$body['plan_id']." WHERE group_id=".$body['group_id']);

    // If switching from household to individual, need to create new groups for each member.
    if ($body['plan_id'] == 1) {
        $sql1 = "SELECT paid_thru FROM groups WHERE group_id=".$body['group_id'];
        $sql2 = "SELECT * FROM group_member WHERE group_id=".$body['group_id'];
        $paid_thru = qVal( $db, $sql1 );
        $members = qSet( $db, $sql2 );

        try {
            for ($i=0; $i < count($members); $i++) {
                if ($i > 0) {                       /// SKIP THE FIRST USER
                    /// GET THE USER ID FROM MEMBER
                    $user_id = qVal($db, "SELECT user_id FROM members WHERE member_id=".$members[$i]['member_id']);

                    // CREATE NEW GROUP
                    $db->query("INSERT INTO groups ( user_id, plan_id, paid_thru ) VALUES ( 0, 1, ".$paid_thru.")");
                    $newId = $db->insert_id;

                    // APPLY NEW PLAN TO USER
                    $db->query("UPDATE group_member SET group_id=".$newId." WHERE member_id=".$members[$i]['member_id']);

                    // UPDATE USER ACCESS
                    $db->query("DELETE FROM group_user WHERE user_id=".$user_id);
                    $db->query("INSERT INTO group_user (group_id, user_id) VALUES (".$newId.", ".$user_id.")" );
                }
            }
        } catch (Exception $e) {
            response(400, ['success' => false, 'error' => $e]);
        }
    }
    response(200, ['success' => true]);
}



//**********************************************************************************************************//
// Method: POST
// Endpoint: pwreset
// Params: none
// Description: Send an email with the password reset link
function post_v1_auth_pwreset( $args, $body, $uid, $is_admin, $db ){
    $rules = [
        'email' => 'req,email',
    ];
    validate_body( $body, $rules );

    $user = qRow( $db, "SELECT u.*, m.* FROM users as u, members as m WHERE u.email='".$body['email']."' AND u.user_id=m.user_id");
    $user['reset_hash'] = generateHash(10);

    if ($user['user_id']) {
        try {
            $upd = "UPDATE users SET reset_hash='".$user['reset_hash']."' WHERE user_id=".$user['user_id'];
            $db->query($upd);

            $body['body'] = '
                <p>Someone requested a link to reset your password at the Penn Hills Community Development Corp members portal.</p>
                <p><b>Click this link to reset your password:</b>
                <br/><a href="https://members.pennhillscdc.org/pwreset-form/'.$user['reset_hash'].'">https://members.pennhillscdc.org/pwreset-form/'.$user['reset_hash'].'</a>
                </p>
                <p>If you did not request this password reset link, you can ignore this message.</p>
                <p>If you continue to receive these emails, please contact Alan Waldron at <a href="mailto:alan.waldron@pennhillscdc.org">alan.waldron@pennhillscdc.org</a></p>
            ';
            $body['subject'] = 'Reset Your Password';

            $email = get_email_template( $body, $user, 0 );

            $mail = new PHPMailer\PHPMailer\PHPMailer(true);
            $mail->isSMTP();
            $mail->SMTPOptions = array(
                'ssl' => array(
                    'verify_peer' => false,
                    'verify_peer_name' => false,
                    'allow_self_signed' => true
                )
            );
            $mail->Host = "mail.smtp2go.com";
            $mail->Port = "2525";
            $mail->SMTPAuth = true;
            $mail->SMTPSecure = 'tls';
            $mail->Username = "pennhillscdc";
            $mail->Password = "xVnXrJGR76RMycPL";

            $mail->setFrom("noreply@pennhillscdc.org", "Penn Hills CDC");
            $mail->AddAddress($user['email'], $user['fname'].' '.$user['lname']);

            $mail->isHTML(true);
            $mail->Subject = "PHCDC: Your Password Reset Link";
            $mail->Body = $email;

            $mail->send();

        } catch (Exception $e) {
            $errors[] = $mail->ErrorInfo;
        }

    }
    response(200, ['success' => true]);
}


//**********************************************************************************************************//
// Method: POST
// Endpoint: pwresetsubmit
// Params: none
// Description: Submit a new password in the reset flow
function post_v1_auth_pwresetsubmit( $args, $body, $uid, $is_admin, $db ) {
    $rules = [
        'password' => 'req',
        'reset_hash' => 'req',
    ];
    validate_body( $body, $rules );

    try {
        $upd = "UPDATE users SET password_hash='".password_hash($body['password'], PASSWORD_BCRYPT)."', reset_hash='' WHERE reset_hash='".$body['reset_hash']."'";
        $db->query($upd);
        response(200, ['success' => true]);
    }
    catch (Exception $e) {
        response(400, ['success' => false, 'error' => $e]);
    }


}



//**********************************************************************************************************//
// Method: POST
// Endpoint: pwresetsubmit
// Params: none
// Description: Submit a new password in the reset flow
function get_v1_auth_genmailcode( $args, $body, $uid, $is_admin, $db ) {
    
    $users = qSet( $db, "SELECT * FROM members WHERE mailcode IS NULL");
	$ctr = 0;
	
    foreach ($users as $u) {
	    $upd = "UPDATE members SET mailcode='".randomString(16)."' WHERE member_id=".$u['member_id'];
	    $db->query($upd);
		$ctr++;
	}

	response(200, ['success' => true, 'users'=>count($users), 'updated'=>$ctr]);

}